What’s Vulnerable › Vulnerabilities

CVE-2019-20801

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-05-18 · updated 2026-06-17
• Weakness: CWE-862

Description

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code (that accesses a user's data) via cross-origin requests.

Affected products

• Readdle Documents: before 6.9.7 — fixed in 6.9.7

How to fix

Upgrade to a fixed version: Readdle Documents 6.9.7. Check the vendor advisory for mitigations.

References

• https://apps.apple.com/us/app/documents-by-readdle/id364901807
• https://logicaltrust.net/blog/2019/12/documents.html#authorization
• https://apps.apple.com/us/app/documents-by-readdle/id364901807
• https://logicaltrust.net/blog/2019/12/documents.html#authorization

Get alerted when CVE-2019-20801 or the next vulnerability affects your stack