FKIE_CVE-2019-8632

Vulnerability from fkie_nvd - Published: 2019-12-18 18:15 - Updated: 2026-06-17 02:42
Severity
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network position may be able to intercept analytics data.
References
product-security@apple.comhttps://support.apple.com/HT210110Vendor Advisory
product-security@apple.comhttps://support.apple.com/HT210111Vendor Advisory
product-security@apple.comhttps://www.info-sec.ca/advisories/Texture.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT210110Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT210111Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.info-sec.ca/advisories/Texture.htmlThird Party Advisory
Impacted products
Vendor Product Version
apple texture *
apple texture *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Texture-iOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "Texture 5.11.10 for iOS",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Texture-Android",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "Texture 4.22.0.4 for Android",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "product-security@apple.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:texture:*:*:*:*:*:android:*:*",
              "matchCriteriaId": "1A174DBC-36E1-456B-A3BC-E3325E6DA618",
              "versionEndExcluding": "4.22.0.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:texture:*:*:*:*:*:ios:*:*",
              "matchCriteriaId": "E7E71850-7929-4027-B348-6B3EEA27A588",
              "versionEndExcluding": "5.11.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network position may be able to intercept analytics data."
    },
    {
      "lang": "es",
      "value": "Algunos datos anal\u00edticos fueron enviados utilizando HTTP en lugar de HTTPS. Esto fue abordado al dejar de enviar estos datos anal\u00edticos. Este problema es corregido en Texture versi\u00f3n 5.11.10 para iOS, Texture versi\u00f3n 4.22.0.4 para Android. Un atacante en una posici\u00f3n de red privilegiada puede ser capaz de interceptar datos anal\u00edticos."
    }
  ],
  "id": "CVE-2019-8632",
  "lastModified": "2026-06-17T02:42:17.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-12-18T18:15:30.567",
  "references": [
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/HT210110"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/HT210111"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.info-sec.ca/advisories/Texture.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/HT210110"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/HT210111"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.info-sec.ca/advisories/Texture.html"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.