← Retour aux CVEs

CVE-2024-44309

MEDIUMCISA KEV

6.3

Description

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Details CVE

Score CVSS v3.16.3

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie11/20/2024

Derniere modification4/3/2026

Sourcekev

Observations honeypot0

CISA KEV

FournisseurApple

ProduitMultiple Products

Nom vulnerabiliteApple Multiple Products Cross-Site Scripting (XSS) Vulnerability

Date ajout KEV2024-11-21

Date limite remediation2024-12-12

Utilise dans ransomwareUnknown

Produits affectes

apple:ipadosapple:iphone_osapple:macosapple:safariapple:visionosdebian:debian_linux

Faiblesses (CWE)

CWE-79

References

https://support.apple.com/en-us/121752(product-security@apple.com)

https://support.apple.com/en-us/121753(product-security@apple.com)

https://support.apple.com/en-us/121754(product-security@apple.com)

https://support.apple.com/en-us/121755(product-security@apple.com)

https://support.apple.com/en-us/121756(product-security@apple.com)

http://seclists.org/fulldisclosure/2024/Nov/16(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44309(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.