CVE-2022-22599 — Incorrect Permission Assignment in Apple IOS AND Ipados

CWE-732 — Incorrect Permission Assignment6 documents3 sources
Severity
2.4LOWNVD
EPSS
0.0%
top 85.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Apple IOS AND IpadosApple MacosApple Watchos+5 more
Timeline
PublishedMar 18
Latest updateMar 19

Description

Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 8.5, iOS 15.4 and iPadOS 15.4, macOS Big Sur 11.6.5, macOS Monterey 12.3. A person with physical access to a device may be able to use Siri to obtain some location information from the lock screen.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 0.9 | Impact: 1.4

Affected Packages11 packages

▶CVEListV5apple/macosunspecified — 12.3+1
▶NVDapple/macos12.0.0 — 12.3+1
▶Appleapple/macos_big_sur11.6.5
▶NVDapple/ipados< 15.4

🔴Vulnerability Details

1
GHSA
GHSA-2q5f-7w6h-jm6x: Description: A permissions issue was addressed with improved validation↗2022-03-19
▶

📋Vendor Advisories

4
Apple
CVE-2022-22599: macOS Monterey 12.3↗2022-03-14
▶
Apple
CVE-2022-22599: watchOS 8.5↗2022-03-14
▶
Apple
CVE-2022-22599: iOS 15.4 and iPadOS 15.4↗2022-03-14
▶
Apple
CVE-2022-22599: macOS Big Sur 11.6.5↗2022-03-14
▶