This issue was addressed through improved state management. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content may lead to universal cross site scripting.
References
Link | Resource |
---|---|
https://support.apple.com/en-us/121238 | Release Notes Vendor Advisory |
https://support.apple.com/en-us/121240 | Release Notes Vendor Advisory |
https://support.apple.com/en-us/121241 | Release Notes Vendor Advisory |
https://support.apple.com/en-us/121248 | Release Notes Vendor Advisory |
https://support.apple.com/en-us/121249 | Release Notes Vendor Advisory |
https://support.apple.com/en-us/121250 | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
25 Sep 2024, 13:41
Type | Values Removed | Values Added |
---|---|---|
References | () https://support.apple.com/en-us/121238 - Release Notes, Vendor Advisory | |
References | () https://support.apple.com/en-us/121240 - Release Notes, Vendor Advisory | |
References | () https://support.apple.com/en-us/121241 - Release Notes, Vendor Advisory | |
References | () https://support.apple.com/en-us/121248 - Release Notes, Vendor Advisory | |
References | () https://support.apple.com/en-us/121249 - Release Notes, Vendor Advisory | |
References | () https://support.apple.com/en-us/121250 - Release Notes, Vendor Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
CPE | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
|
First Time |
Apple watchos
Apple macos Apple iphone Os Apple Apple ipados Apple safari Apple tvos Apple visionos |
|
CWE | CWE-79 |
20 Sep 2024, 12:31
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
17 Sep 2024, 00:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-09-17 00:15
Updated : 2024-09-25 13:41
NVD link : CVE-2024-40857
Mitre link : CVE-2024-40857
CVE.ORG link : CVE-2024-40857
JSON object : View
Products Affected
apple
- macos
- ipados
- safari
- visionos
- watchos
- iphone_os
- tvos
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')