CVE-2024-23255

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. Photos in the Hidden Photos Album may be viewed without authentication.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://seclists.org/fulldisclosure/2024/Mar/21	Mailing List
https://support.apple.com/en-us/HT214081	Vendor Advisory
https://support.apple.com/en-us/HT214084	Vendor Advisory
http://seclists.org/fulldisclosure/2024/Mar/21	Mailing List
https://support.apple.com/en-us/HT214081	Vendor Advisory
https://support.apple.com/en-us/HT214084	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipad_os::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::

History

06 Dec 2024, 02:51

Type	Values Removed	Values Added
CPE		cpe:2.3:o:apple:ipad_os:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~9.1~~	v2 : unknown v3 : 2.4
CWE		CWE-287
First Time		Apple ipad Os Apple iphone Os Apple Apple macos
References	~~() http://seclists.org/fulldisclosure/2024/Mar/21 -~~	() http://seclists.org/fulldisclosure/2024/Mar/21 - Mailing List
References	~~() https://support.apple.com/en-us/HT214081 -~~	() https://support.apple.com/en-us/HT214081 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT214084 -~~	() https://support.apple.com/en-us/HT214084 - Vendor Advisory

Information

Published : 2024-03-08 02:15

Updated : 2024-12-06 02:51

NVD link : CVE-2024-23255

Mitre link : CVE-2024-23255

CVE.ORG link : CVE-2024-23255

JSON object : View

Products Affected

apple

iphone_os
macos
ipad_os

CWE

CWE-287

Improper Authentication

CWE-863

Incorrect Authorization

{"id": "CVE-2024-23255", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-03-08T02:15:48.713", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Mar/21", "tags": ["Mailing List"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/HT214081", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/HT214084", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/21", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/en-us/HT214081", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/en-us/HT214084", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. Photos in the Hidden Photos Album may be viewed without authentication."}, {"lang": "es", "value": "Se solucion\u00f3 un problema de autenticaci\u00f3n con una gesti\u00f3n de estado mejorada. Este problema se solucion\u00f3 en macOS Sonoma 14.4, iOS 17.4 y iPadOS 17.4. Las fotos del \u00c1lbum de fotos ocultas se pueden ver sin autenticaci\u00f3n."}], "lastModified": "2024-12-06T02:51:33.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE5413B9-A1A8-499F-B047-163908202E69", "versionEndExcluding": "17.4"}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCB4911E-7824-4C34-916D-88110CB415EB", "versionEndExcluding": "17.4"}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73160D1F-755B-46D2-969F-DF8E43BB1099", "versionEndExcluding": "14.4", "versionStartIncluding": "14.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}