PT-2014-5912

CVE-2014-4450

Published

2014-10-22

Updated

2017-08-29

Description by

CVSS 2.0

1.9

Low

MetricsAV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1

Description The issue concerns the QuickType feature in the Keyboards subsystem, which collects typing-prediction data from fields even when the autocomplete attribute is set to off. This behavior potentially allows attackers to discover credentials by reading credential values within unintended DOM input elements.

Recommendations For Apple iOS versions prior to 8.1, update to version 8.1 or later to resolve the issue.

Exploitability

Fix

Researchers

Bodo Moeller

Krzysztof Kotowicz

Thai Duong

Vendors

Affected products

Weakness enumeration

CWE-255

Related identifiers