CVE-2024-23273

CWE-295 — Improper Certificate Validation6 documents4 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 54.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple IOS AND IpadosApple MacosApple Safari+2 more
Timeline
PublishedMar 8

Description

This issue was addressed through improved state management. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Private Browsing tabs may be accessed without authentication.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages7 packages

▶CVEListV5apple/macos< 14.4
▶NVDapple/macos14.0 — 14.4
▶CVEListV5apple/safari< 17.4
▶NVDapple/safari< 17.4
▶NVDapple/ipad_os< 17.4

🔴Vulnerability Details

2
CVEList
CVE-2024-23273: This issue was addressed through improved state management↗2024-03-08
▶
GHSA
GHSA-qg9g-p9q2-wjvw: This issue was addressed through improved state management↗2024-03-08
▶

📋Vendor Advisories

3
Apple
CVE-2024-23273: macOS Sonoma 14.4↗2024-03-07
▶
Apple
CVE-2024-23273: Safari 17.4↗2024-03-07
▶
Apple
CVE-2024-23273: iOS 17.4 and iPadOS 17.4↗2024-03-05
▶