6.8med
CVE-2018-9840
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rap…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 36%
Public exploits
0
none known
Summary
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using the home button.
Exploit prediction (EPSS)
0.42% probability of exploitation in the next 30 days, higher than 36% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.8 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
References
- github.com /signalapp/Signal-iOS/commit/018a35df7b42b4941cb4dfc9f462b37c3fafd9e9 · x_refsource_MISC, x_transferred
- github.com /signalapp/Signal-iOS/commits/release/2.23.2 · x_refsource_MISC, x_transferred
- nint.en.do /Signal-Bypass-Screen-locker.php · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-9840
- NVD: CVE-2018-9840
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.