Skip to content
Fencer Vulns
medium 5.3

CVE-2020-9916 json

A URL Unicode encoding issue was addressed with improved state management.

published 2020-10-16 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-30695

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

A URL Unicode encoding issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A malicious attacker may be able to conceal the destination of a URL.

Patch / fix

  • Apple iOS iOS 13.6 and iPadOS 13.6
  • Apple tvOS tvOS 13.4.8
  • Apple watchOS watchOS 6.2.8
  • Apple Safari Safari 13.1.2
  • Apple iTunes for Windows iTunes 12.10.8 for Windows
  • Apple iCloud for Windows iCloud for Windows 11.3
  • Apple iCloud for Windows (Legacy) iCloud for Windows 7.20

Exploit prediction

1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Apple iOS
  • Apple tvOS
  • Apple watchOS
  • Apple Safari
  • Apple iTunes for Windows
  • Apple iCloud for Windows
  • Apple iCloud for Windows (Legacy)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.