CVE-2024-44309

CVE Details

Release Date:

2024-11-20

Description

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

See more information about CVE-2024-44309 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.1
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	Required
Scope:	Changed
Confidentiality:	Low
Integrity:	Low
Availability:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (webkit2gtk3)	ELSA-2024-10481	2024-11-27
Oracle Linux version 9 (webkit2gtk3)	ELSA-2024-10472	2024-11-27