CVE-2024-44309 KEV
6.3
MEDIUM · CVSS 3.1 · EPSS 22.6% (pctl 98)
Patch first
On CISA KEV — known exploited in the wild, due 2024-12-12.
Description
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
Scoring
| CVSS | 6.3 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| EPSS | 22.59% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | yes — remediate by 2024-12-12 |
| Public exploit | none known |
| Published | 2024-11-20 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability |
|---|---|
| Added | 2024-11-21 |
| Due | 2024-12-12 |
| Vendor / product | Apple / Multiple Products |
| Ransomware use | none reported |
Affected (6)
| Vendor | Product |
|---|---|
| apple | ipados |
| apple | iphone os |
| apple | macos |
| apple | safari |
| apple | visionos |
| debian | debian linux |
References
- https://support.apple.com/en-us/121752
- https://support.apple.com/en-us/121753
- https://support.apple.com/en-us/121754
- https://support.apple.com/en-us/121755
- https://support.apple.com/en-us/121756
- http://seclists.org/fulldisclosure/2024/Nov/16
- https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44309
→ the Explorer · watch your stack · NVD