Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-44269: Apple devices may let apps read restricted files
CVE-2024-44269 · published 2 years ago
Summary
A flaw in iOS, iPadOS, macOS, visionOS and watchOS could allow a malicious app to use shortcuts to reach files it should not access. This could expose sensitive data stored on the device. Updating to the latest OS versions for each platform resolves the issue.
What to do
- Update apple visionos to version 2.1 or later.
- Update apple watchos to version 11.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apple | ipados |
< 17.7.1 >= 18.0, < 18.1 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| apple | iphone_os |
< 17.7.1 >= 18.0, < 18.1 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| apple | macos |
< 13.7.1 >= 14.0, < 14.7.1 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| apple | visionos |
< 2.1 cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* |
| apple | watchos |
< 11.1 cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
Original advisory text
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visio...
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2.1, watchOS 11.1. A malicious app may use shortcuts to access restricted files.
References
- https://support.apple.com/en-us/121563 Release Notes Vendor Advisory
- https://support.apple.com/en-us/121565 Release Notes Vendor Advisory
- https://support.apple.com/en-us/121566 Release Notes Vendor Advisory
- https://support.apple.com/en-us/121564
- https://support.apple.com/en-us/121567 Release Notes Vendor Advisory
- https://support.apple.com/en-us/121568 Release Notes Vendor Advisory
- https://support.apple.com/en-us/121570 Release Notes Vendor Advisory
- http://seclists.org/fulldisclosure/2024/Oct/10
- http://seclists.org/fulldisclosure/2024/Oct/11
- http://seclists.org/fulldisclosure/2024/Oct/12
- http://seclists.org/fulldisclosure/2024/Oct/13
- http://seclists.org/fulldisclosure/2024/Oct/14
- http://seclists.org/fulldisclosure/2024/Oct/16
- http://seclists.org/fulldisclosure/2024/Oct/9
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Timeline
Published28 Oct 2024
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-44269 · NVD
Track software like this
Free during beta