CVE-2024-23291

low-risk
Published 2024-03-08

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. A malicious app may be able to observe user data in log entries related to accessibility notifications.

Do I need to act?

-
0.26% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (5)

Affected Vendors

Apple

References (15)

https://support.apple.com/en-us/120881
https://support.apple.com/en-us/120882
https://support.apple.com/en-us/120893
https://support.apple.com/en-us/120895
Mailing List http://seclists.org/fulldisclosure/2024/Mar/21
Mailing List http://seclists.org/fulldisclosure/2024/Mar/24
Mailing List http://seclists.org/fulldisclosure/2024/Mar/25
Vendor Advisory https://support.apple.com/en-us/HT214081
Vendor Advisory https://support.apple.com/en-us/HT214084
Vendor Advisory https://support.apple.com/en-us/HT214086
Vendor Advisory https://support.apple.com/en-us/HT214088
https://support.apple.com/kb/HT214081
https://support.apple.com/kb/HT214084
https://support.apple.com/kb/HT214086
https://support.apple.com/kb/HT214088
26
/ 100
low-risk
Severity 13/34 · Low
Exploitability 1/34 · Minimal
Exposure 12/34 · Low