# CVE-2020-9934

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

- Page: https://www.vulneraibility.com/cve/CVE-2020-9934
- CVSS: 5.5
- Known exploited: yes, in CISA KEV since 2022-09-08; CISA due date 2022-09-29
- EPSS: 3.21% (percentile 88.3)
- Unvetted proof-of-concept code on GitHub: 1 Metasploit module · 1 GitHub proof of concept (first 2020-07-27)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-01-29)
- Published: 2020-10-16

## Affected versions

- Apple iOS: affected < iOS 13.6 and iPadOS 13.6
- Apple macOS: affected < macOS Catalina 10.15.6

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://support.apple.com/HT211289
- [other] https://support.apple.com/HT211288
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9934

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.