Skip to main content
Apexward Pulse

Apple · Auth bypass

Apple Multiple Products Authentication Bypass Vulnerability

CVE-2024-27834

What this means

This is rated medium severity (5.5 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Apple Safari, Apple Ipados and Apple Iphone Os, and 6 more are in your estate.

Full vendor description

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

Scoring and exploitation

5.5/ 10
CVSS 3.1 base scoreMedium

Exploitable only with local access and a low-privilege account, and no one has to click or open anything. High impact on integrity.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability

Longer bar: easier to attack

Attack vectorLocalAV:L
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityNoneC:N
IntegrityHighI:H
AvailabilityNoneA:N
~1.5% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Apple Multiple Products

Weaknesses

NVD-CWE-noinfoCWE-287

Affected products ()

  • Apple Safari
  • Apple Ipados
  • Apple Iphone Os
  • Apple Macos
  • Apple Tvos
  • Apple Watchos
  • Webkitgtk Webkitgtk
  • Wpewebkit Wpe Webkit
  • Fedoraproject Fedora
Show the raw CPE strings (10)
  • cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
  • cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
  • cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

References

20 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • Apple Multiple Products Authentication Bypass Vulnerability

    Type Vulnerability

    CISA has added one new vulnerability to its known-exploited catalogue, based on evidence of active exploitation.

    Next step: Confirm whether Apple Safari is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 2Vendor statement missing. no VendorResearcher coverage missing. no Researcher2 signals

    Only official coverage so far. Treat as an early signal.

    Apple SafariWebkitgtkWpewebkit Wpe Webkit
    CVE-2024-27834