CVE-2024-44175

Published Oct 28, 2024

Last updated 18 days ago

CVSS medium 5.5

Overview

Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensitive user data.
Source: product-security@apple.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-59
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-922

Hype score: Not currently trending

🍎🐛🎙️Following my #poc2024 talk we are releasing a blogpost series @KandjiMDM detailing the vulnerabilities of diskarbitrationd and storagekitd I discussed in my "Apple Disk-O Party" talk. First part is out, and covers CVE-2024-44175. https://t.co/IJzpHDOxjn
@theevilbit
8 Nov 2024
4037 Impressions
22 Retweets
75 Likes
22 Bookmarks
2 Replies
0 Quotes

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "20977171-B964-4F89-AF53-6136003EDDB2",
            "versionEndExcluding": "14.7.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References