5.5med
CVE-2024-27872
This issue was addressed with improved validation of symlinks.
Published 2 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 17%
Public exploits
0
none known
Summary
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protected user data.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.25% probability of exploitation in the next 30 days, higher than 17% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Apple macOS
Classification
- Weakness
- CWE-61 UNIX Symbolic Link (Symlink) Following
References
- support.apple.com /en-us/120911
- support.apple.com /en-us/HT214119 · x_transferred
- seclists.org /fulldisclosure/2024/Jul/18 · x_transferred
- support.apple.com /kb/HT214119
Sources
- CVE List: CVE-2024-27872
- NVD: CVE-2024-27872
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.