CVE-2019-8898

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An information disclosure issue existed in the handling of the Storage Access API. This issue was addressed with improved logic. This issue is fixed in iOS 13.3 and iPadOS 13.3, tvOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows. Visiting a maliciously crafted website may reveal sites a user has visited.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Apple	iOS and iPadOS	>= unspecified, < 13.3
Apple	tvOS	>= unspecified, < 13.3
Apple	Safari	>= unspecified, < 13.0
Apple	iTunes for Windows	>= unspecified, < 12.10

References

https://support.apple.com/en-us/HT210785Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT210790Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT210792Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT210793Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT210785Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT210790Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT210792Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT210793Release Notes, Vendor Advisory

Timeline

Published: Oct 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-89006.8A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon CVE-2019-89016.5This issue was addressed by verifying host keys when connecting to a previously-known SSH server. This issue is fixed in iOS 13.1 and iPadOS CVE-2019-89025.7An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user U CVE-2019-89037.5index.js in Total.js Platform before 3.2.3 allows path traversal.CVE-2019-89048.8do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf.CVE-2019-89054.4do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerabilit CVE-2019-89064.4do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.CVE-2019-89078.8do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application CVE-2019-89089.8An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configura CVE-2019-89097.5An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions CVE-2019-89108.8An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=site_post CSRF.CVE-2019-89116.1An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code).