Log in Start free

Actively exploited · Published Nov 19, 2024 · Assigned by apple

CVE-2024-44309

Medium 6.3 Exploited

In plain English

A medium-severity cross-site scripting in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 21, 2024). The chance it is exploited in the next 30 days is estimated at 21.9% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)21.9%top 2.3% of all CVEs
Exploited in the wildYesCISA KEV since Nov 21, 2024
Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Dec 12, 2024.

Official description

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8webkit2gtk32.46.3-2.el8_10ALSA-2024:10481
AlmaLinux:9webkit2gtk32.46.3-2.el9_5ALSA-2024:10472
AlmaLinux:8webkit2gtk3-devel2.46.3-2.el8_10ALSA-2024:10481
AlmaLinux:9webkit2gtk3-devel2.46.3-2.el9_5ALSA-2024:10472
AlmaLinux:8webkit2gtk3-jsc2.46.3-2.el8_10ALSA-2024:10481
AlmaLinux:9webkit2gtk3-jsc2.46.3-2.el9_5ALSA-2024:10472
AlmaLinux:8webkit2gtk3-jsc-devel2.46.3-2.el8_10ALSA-2024:10481
AlmaLinux:9webkit2gtk3-jsc-devel2.46.3-2.el9_5ALSA-2024:10472
Debian:12webkit2gtk2.46.4-1~deb12u1DEBIAN-CVE-2024-44309
Debian:12webkit2gtk2.46.4-1~deb12u1DSA-5823-1
Debian:13webkit2gtk2.46.4-1DEBIAN-CVE-2024-44309
Debian:14webkit2gtk2.46.4-1DEBIAN-CVE-2024-44309
Debian:12wpewebkitno fix listedDEBIAN-CVE-2024-44309
Debian:13wpewebkit2.46.4-1DEBIAN-CVE-2024-44309
Debian:14wpewebkit2.46.4-1DEBIAN-CVE-2024-44309
Rocky Linux:8webkit2gtk30:2.46.3-2.el8_10RLSA-2024:10481
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2024-44309
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2024-44309
Ubuntu:22.04:LTSwebkit2gtk2.46.4-0ubuntu0.22.04.1USN-7142-1
Ubuntu:22.04:LTSwebkit2gtk2.46.4-0ubuntu0.22.04.1UBUNTU-CVE-2024-44309
Ubuntu:24.04:LTSwebkit2gtk2.46.4-0ubuntu0.24.04.1UBUNTU-CVE-2024-44309
Ubuntu:24.04:LTSwebkit2gtk2.46.4-0ubuntu0.24.04.1USN-7142-1
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2024-44309

Affected products (as reported)

VendorProductVersions
Apple Safari 0 – before 18.1.1
Apple iOS and iPadOS 0 – before 17.7.20 – before 18.1.1
Apple macOS 0 – before 15.1.1
Apple visionOS 0 – before 2.1.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References