CVE-2024-40855 — Incorrect Authorization in Apple Macos

CWE-863 — Incorrect Authorization7 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 89.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple MacosApple Visionos
Timeline
PublishedOct 28

Description

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2. A sandboxed app may be able to access sensitive user data.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5apple/macos< 13.7.1+2
▶NVDapple/macos14.0 — 14.7.1+1
▶CVEListV5apple/visionos< 2

🔴Vulnerability Details

2
CVEList
CVE-2024-40855: The issue was addressed with improved checks↗2024-10-28
▶
GHSA
GHSA-qc88-643m-whjm: The issue was addressed with improved checks↗2024-10-28
▶

📋Vendor Advisories

4
Apple
CVE-2024-40855: macOS Sonoma 14.7.1↗2024-10-28
▶
Apple
CVE-2024-40855: macOS Ventura 13.7.1↗2024-10-28
▶
Apple
CVE-2024-40855: visionOS2↗2024-09-16
▶
Apple
CVE-2024-40855: macOS Sequoia 15↗2024-09-16
▶
CVE-2024-40855 — Incorrect Authorization in Apple Macos | cvebase