CVE-2024-27803

A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to share items from the lock screen.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://seclists.org/fulldisclosure/2024/May/10	Mailing List
https://support.apple.com/en-us/HT214101	Vendor Advisory
https://support.apple.com/kb/HT214101	Vendor Advisory
http://seclists.org/fulldisclosure/2024/May/10	Mailing List
https://support.apple.com/en-us/HT214101	Vendor Advisory
https://support.apple.com/kb/HT214101	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::

History

25 Mar 2025, 19:15

Type	Values Removed	Values Added
CWE		CWE-284

09 Dec 2024, 19:19

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2024/May/10 -~~	() http://seclists.org/fulldisclosure/2024/May/10 - Mailing List
References	~~() https://support.apple.com/en-us/HT214101 -~~	() https://support.apple.com/en-us/HT214101 - Vendor Advisory
References	~~() https://support.apple.com/kb/HT214101 -~~	() https://support.apple.com/kb/HT214101 - Vendor Advisory
CPE		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os::::::::
CWE		NVD-CWE-noinfo
First Time		Apple Apple ipados Apple iphone Os
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 2.4

Information

Published : 2024-05-14 15:13

Updated : 2025-03-25 19:15

NVD link : CVE-2024-27803

Mitre link : CVE-2024-27803

CVE.ORG link : CVE-2024-27803

JSON object : View

Products Affected

apple

iphone_os
ipados

CWE

NVD-CWE-noinfo CWE-284

Improper Access Control

{"id": "CVE-2024-27803", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "published": "2024-05-14T15:13:03.823", "references": [{"url": "http://seclists.org/fulldisclosure/2024/May/10", "tags": ["Mailing List"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/HT214101", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/kb/HT214101", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "http://seclists.org/fulldisclosure/2024/May/10", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/en-us/HT214101", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT214101", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to share items from the lock screen."}, {"lang": "es", "value": "Se solucion\u00f3 un problema de permisos con una validaci\u00f3n mejorada. Este problema se solucion\u00f3 en iOS 17.5 y iPadOS 17.5. Un atacante con acceso f\u00edsico puede compartir elementos desde la pantalla de bloqueo."}], "lastModified": "2025-03-25T19:15:42.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7F2E11C-4A7D-4E71-BFAA-396B0549F649", "versionEndExcluding": "17.5"}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9C4B45E-AF58-4D7C-B73A-618B06AED56E", "versionEndExcluding": "17.5"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}