Vulnerability-Lookup

CVE-2024-27821 (GCVE-0-2024-27821)

Vulnerability from cvelistv5 – Published: 2024-05-13 23:00 – Updated: 2026-04-02 18:19

Summary

A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A shortcut may output sensitive user data without consent.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-29 17:36 UTC

CWE

A shortcut may output sensitive user data without consent
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

apple mitre root

References

12 references

URL	Tags
https://support.apple.com/en-us/120902
https://support.apple.com/en-us/120903
https://support.apple.com/en-us/120905
https://support.apple.com/en-us/HT214101	x_transferred
https://support.apple.com/en-us/HT214106	x_transferred
https://support.apple.com/en-us/HT214104	x_transferred
http://seclists.org/fulldisclosure/2024/May/10	x_transferred
https://support.apple.com/kb/HT214104	x_transferred
https://support.apple.com/kb/HT214106	x_transferred
http://seclists.org/fulldisclosure/2024/May/12	x_transferred
http://seclists.org/fulldisclosure/2024/May/16	x_transferred
https://support.apple.com/kb/HT214101	x_transferred

Impacted products

7 products

Vendor	Product	Version	CPE status
Apple	iOS and iPadOS	Affected: 0 , < 17.5 (custom)	guessed
Apple	macOS	Affected: 0 , < 14.5 (custom)	guessed
Apple	watchOS	Affected: 0 , < 10.5 (custom)	guessed
apple	macos	Affected: 0 , < 14.5 (custom) cpe:2.3:o:apple:macos::::::::
apple	watchos	Affected: 0 , < 10.5 (custom) cpe:2.3:o:apple:watchos::::::::
apple	ios	Affected: 0 , < 17.5 (custom) cpe:2.3:o:apple:ios::::::::
apple	ipad_os	Affected: 0 , < 17.5 (custom) cpe:2.3:o:apple:ipad_os::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "macos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "14.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "watchos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "10.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ios",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ipad_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T17:36:34.101116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-31T18:18:38.684Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.861Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214101"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214106"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214104"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/May/10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214104"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214106"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/May/12"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/May/16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214101"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A shortcut may output sensitive user data without consent."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A shortcut may output sensitive user data without consent",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:19:25.443Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120902"
        },
        {
          "url": "https://support.apple.com/en-us/120903"
        },
        {
          "url": "https://support.apple.com/en-us/120905"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-27821",
    "datePublished": "2024-05-13T23:00:53.440Z",
    "dateReserved": "2024-02-26T15:32:28.523Z",
    "dateUpdated": "2026-04-02T18:19:25.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27821",
      "date": "2026-09-19",
      "epss": "0.00915",
      "percentile": "0.58618"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E7F2E11C-4A7D-4E71-BFAA-396B0549F649",
                  "versionEndExcluding": "17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E9C4B45E-AF58-4D7C-B73A-618B06AED56E",
                  "versionEndExcluding": "17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6AB18623-7D06-4946-99FC-808A4A913ED9",
                  "versionEndExcluding": "14.5",
                  "versionStartIncluding": "14.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CC4B1E01-BE73-48F8-9BD5-32F7C57EB45A",
                  "versionEndExcluding": "10.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A shortcut may output sensitive user data without consent."
        },
        {
          "lang": "es",
          "value": "Se solucion\u00f3 un problema de manejo de rutas con una validaci\u00f3n mejorada. Este problema se solucion\u00f3 en iOS 17.5 y iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Un acceso directo puede generar datos confidenciales del usuario sin consentimiento."
        }
      ],
      "id": "CVE-2024-27821",
      "lastModified": "2024-12-12T14:33:00.640",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 1.0,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-05-14T15:13:05.287",
      "references": [
        {
          "source": "product-security@apple.com",
          "tags": [
            "Mailing List"
          ],
          "url": "http://seclists.org/fulldisclosure/2024/May/10"
        },
        {
          "source": "product-security@apple.com",
          "tags": [
            "Mailing List"
          ],
          "url": "http://seclists.org/fulldisclosure/2024/May/12"
        },
        {
          "source": "product-security@apple.com",
          "tags": [
            "Mailing List"
          ],
          "url": "http://seclists.org/fulldisclosure/2024/May/16"
        },
        {
          "source": "product-security@apple.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/en-us/HT214101"
        },
        {
          "source": "product-security@apple.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/en-us/HT214104"
        },
        {
          "source": "product-security@apple.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/en-us/HT214106"
        },
        {
          "source": "product-security@apple.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/kb/HT214101"
        },
        {
          "source": "product-security@apple.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/kb/HT214104"
        },
        {
          "source": "product-security@apple.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/kb/HT214106"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List"
          ],
          "url": "http://seclists.org/fulldisclosure/2024/May/10"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List"
          ],
          "url": "http://seclists.org/fulldisclosure/2024/May/12"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List"
          ],
          "url": "http://seclists.org/fulldisclosure/2024/May/16"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/en-us/HT214101"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/en-us/HT214104"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/en-us/HT214106"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/kb/HT214101"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/kb/HT214104"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/kb/HT214106"
        }
      ],
      "sourceIdentifier": "product-security@apple.com",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ],
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "iOS and iPadOS",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "17.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "macOS",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "14.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "watchOS",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "10.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "product-security@apple.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "macos",
                "vendor": "apple",
                "versions": [
                  {
                    "lessThan": "14.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "watchos",
                "vendor": "apple",
                "versions": [
                  {
                    "lessThan": "10.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "ios",
                "vendor": "apple",
                "versions": [
                  {
                    "lessThan": "17.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "ipad_os",
                "vendor": "apple",
                "versions": [
                  {
                    "lessThan": "17.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7F2E11C-4A7D-4E71-BFAA-396B0549F649",
                    "versionEndExcluding": "17.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9C4B45E-AF58-4D7C-B73A-618B06AED56E",
                    "versionEndExcluding": "17.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6AB18623-7D06-4946-99FC-808A4A913ED9",
                    "versionEndExcluding": "14.5",
                    "versionStartIncluding": "14.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC4B1E01-BE73-48F8-9BD5-32F7C57EB45A",
                    "versionEndExcluding": "10.5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A shortcut may output sensitive user data without consent."
          },
          {
            "lang": "es",
            "value": "Se solucion\u00f3 un problema de manejo de rutas con una validaci\u00f3n mejorada. Este problema se solucion\u00f3 en iOS 17.5 y iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Un acceso directo puede generar datos confidenciales del usuario sin consentimiento."
          }
        ],
        "id": "CVE-2024-27821",
        "lastModified": "2026-06-17T07:20:22.790",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-27821",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T17:36:34.101116Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-14T15:13:05.287",
        "references": [
          {
            "source": "product-security@apple.com",
            "url": "https://support.apple.com/en-us/120902"
          },
          {
            "source": "product-security@apple.com",
            "url": "https://support.apple.com/en-us/120903"
          },
          {
            "source": "product-security@apple.com",
            "url": "https://support.apple.com/en-us/120905"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/May/10"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/May/12"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/May/16"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/HT214101"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/HT214104"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/HT214106"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/kb/HT214101"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/kb/HT214104"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/kb/HT214106"
          }
        ],
        "sourceIdentifier": "product-security@apple.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-04-02T22:57:48+00:00",
      "cve": "CVE-2024-27821",
      "id": "CVE-2024-27821",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-27821",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27821.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:41:54.861Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/en-us/HT214101"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/en-us/HT214106"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/en-us/HT214104"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://seclists.org/fulldisclosure/2024/May/10"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/kb/HT214104"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/kb/HT214106"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://seclists.org/fulldisclosure/2024/May/12"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://seclists.org/fulldisclosure/2024/May/16"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/kb/HT214101"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "macos",
                "vendor": "apple",
                "versions": [
                  {
                    "lessThan": "14.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "watchos",
                "vendor": "apple",
                "versions": [
                  {
                    "lessThan": "10.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "ios",
                "vendor": "apple",
                "versions": [
                  {
                    "lessThan": "17.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "ipad_os",
                "vendor": "apple",
                "versions": [
                  {
                    "lessThan": "17.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-27821",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-29T17:36:34.101116Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-22",
                    "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-29T17:33:23.816Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "iOS and iPadOS",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "17.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "macOS",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "14.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "watchOS",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "10.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A shortcut may output sensitive user data without consent."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "A shortcut may output sensitive user data without consent",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-02T18:19:25.443Z",
            "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
            "shortName": "apple"
          },
          "references": [
            {
              "url": "https://support.apple.com/en-us/120902"
            },
            {
              "url": "https://support.apple.com/en-us/120903"
            },
            {
              "url": "https://support.apple.com/en-us/120905"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "assignerShortName": "apple",
        "cveId": "CVE-2024-27821",
        "datePublished": "2024-05-13T23:00:53.440Z",
        "dateReserved": "2024-02-26T15:32:28.523Z",
        "dateUpdated": "2026-04-02T18:19:25.443Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2024-AVI-0392

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Apple	N/A	iOS and iPadOS versions 16.x antérieures à 16.7.8
Apple	Safari	Safari versions antérieures à 17.5
Apple	N/A	tvOS versions antérieures à 17.5
Apple	N/A	iOS and iPadOS versions 17.x antérieures à 17.5
Apple	macOS	macOS Sonoma versions antérieures à 14.5
Apple	macOS	macOS Monterey versions antérieures à 12.7.5
Apple	N/A	watchOS versions antérieures à 10.5
Apple	macOS	macOS Ventura versions antérieures à 13.6.7

References

Title

Publication Time

CERTFR-2024-AVI-0392

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Apple	N/A	iOS and iPadOS versions 16.x antérieures à 16.7.8
Apple	Safari	Safari versions antérieures à 17.5
Apple	N/A	tvOS versions antérieures à 17.5
Apple	N/A	iOS and iPadOS versions 17.x antérieures à 17.5
Apple	macOS	macOS Sonoma versions antérieures à 14.5
Apple	macOS	macOS Monterey versions antérieures à 12.7.5
Apple	N/A	watchOS versions antérieures à 10.5
Apple	macOS	macOS Ventura versions antérieures à 13.6.7

References

Title

Publication Time

BDU:2024-10239 (CVE-2024-27821)

Vulnerability from fstec – Published: 2024-11-26 – Updated: 2024-11-26 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость компонента Shortcuts операционных систем iOS, iPadOS, watchOS, macOS, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным

Summary

Уязвимость компонент Shortcuts операционных систем iOS, iPadOS, watchOS, macOS связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к конфиденциальным данным

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:N/A:N

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-22 - Неверное ограничение имени пути к каталогу с ограниченным доступом («Обход пути»)

Aliases

CVE-2024-27821

References

12 references

URL
https://securityonline.info/workflowkit-race-vulnerability-cve-2024-27821-resea…
http://seclists.org/fulldisclosure/2024/May/10
http://seclists.org/fulldisclosure/2024/May/12
http://seclists.org/fulldisclosure/2024/May/16
https://support.apple.com/en-us/HT214101
https://support.apple.com/en-us/HT214104
https://support.apple.com/en-us/HT214106
https://support.apple.com/kb/HT214101
https://support.apple.com/kb/HT214104
https://support.apple.com/kb/HT214106
https://github.com/0xilis/CVE-2024-27821
https://snoolie.gay/blog/CVE-2024-27821

Impacted products

4 products from 1 vendor

Vendors

Apple Inc.

Products

MacOS, iOS, iPadOS, watchOS

Versions

до 14.5 (MacOS), до 17.5 (iOS), до 17.5 (iPadOS), до 10.5 (watchOS)

Product types

Operating system

Platforms

Apple Inc. MacOS до 14.5, Apple Inc. iOS до 17.5, Apple Inc. iPadOS до 17.5, Apple Inc. watchOS до 10.5

Mitigations

Использование рекомендаций: http://seclists.org/fulldisclosure/2024/May/10 http://seclists.org/fulldisclosure/2024/May/12 http://seclists.org/fulldisclosure/2024/May/16 https://support.apple.com/en-us/HT214101 https://support.apple.com/en-us/HT214104 https://support.apple.com/en-us/HT214106 https://support.apple.com/kb/HT214101 https://support.apple.com/kb/HT214104 https://support.apple.com/kb/HT214106

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Apple Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 14.5 (MacOS), \u0434\u043e 17.5 (iOS), \u0434\u043e 17.5 (iPadOS), \u0434\u043e 10.5 (watchOS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttp://seclists.org/fulldisclosure/2024/May/10\t\nhttp://seclists.org/fulldisclosure/2024/May/12\t\nhttp://seclists.org/fulldisclosure/2024/May/16\t\nhttps://support.apple.com/en-us/HT214101\t\nhttps://support.apple.com/en-us/HT214104\t\nhttps://support.apple.com/en-us/HT214106\t\nhttps://support.apple.com/kb/HT214101\t\nhttps://support.apple.com/kb/HT214104\t\nhttps://support.apple.com/kb/HT214106",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.05.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "26.11.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "26.11.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-10239",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-27821",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "MacOS, iOS, iPadOS, watchOS",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Apple Inc. MacOS \u0434\u043e 14.5 , Apple Inc. iOS \u0434\u043e 17.5 , Apple Inc. iPadOS \u0434\u043e 17.5 , Apple Inc. watchOS \u0434\u043e 10.5 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Shortcuts \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c iOS, iPadOS, watchOS, macOS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c (\u00ab\u041e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438\u00bb) (CWE-22)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 Shortcuts \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c iOS, iPadOS, watchOS, macOS \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u0438\u043c\u0435\u043d\u0438 \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://securityonline.info/workflowkit-race-vulnerability-cve-2024-27821-researcher-reveals-exploit-that-let-malicious-apps-hijack-shortcuts/\nhttp://seclists.org/fulldisclosure/2024/May/10\t\nhttp://seclists.org/fulldisclosure/2024/May/12\t\nhttp://seclists.org/fulldisclosure/2024/May/16\t\nhttps://support.apple.com/en-us/HT214101\t\nhttps://support.apple.com/en-us/HT214104\t\nhttps://support.apple.com/en-us/HT214106\t\nhttps://support.apple.com/kb/HT214101\t\nhttps://support.apple.com/kb/HT214104\t\nhttps://support.apple.com/kb/HT214106\nhttps://github.com/0xilis/CVE-2024-27821\nhttps://snoolie.gay/blog/CVE-2024-27821",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-22",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

FKIE_CVE-2024-27821

Vulnerability from fkie_nvd - Published: 2024-05-14 15:13 - Updated: 2026-06-17 07:20

Severity

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
product-security@apple.com	https://support.apple.com/en-us/120902
product-security@apple.com	https://support.apple.com/en-us/120903
product-security@apple.com	https://support.apple.com/en-us/120905
af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2024/May/10	Mailing List
af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2024/May/12	Mailing List
af854a3a-2127-422b-91ae-364da2661108	http://seclists.org/fulldisclosure/2024/May/16	Mailing List
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/en-us/HT214101	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/en-us/HT214104	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/en-us/HT214106	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/kb/HT214101	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/kb/HT214104	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/kb/HT214106	Vendor Advisory

Impacted products

Vendor	Product	Version
apple	ipados	*
apple	iphone_os	*
apple	macos	*
apple	watchos	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "product-security@apple.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "macos",
          "vendor": "apple",
          "versions": [
            {
              "lessThan": "14.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "watchos",
          "vendor": "apple",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "ios",
          "vendor": "apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "ipad_os",
          "vendor": "apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7F2E11C-4A7D-4E71-BFAA-396B0549F649",
              "versionEndExcluding": "17.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E9C4B45E-AF58-4D7C-B73A-618B06AED56E",
              "versionEndExcluding": "17.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AB18623-7D06-4946-99FC-808A4A913ED9",
              "versionEndExcluding": "14.5",
              "versionStartIncluding": "14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC4B1E01-BE73-48F8-9BD5-32F7C57EB45A",
              "versionEndExcluding": "10.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A shortcut may output sensitive user data without consent."
    },
    {
      "lang": "es",
      "value": "Se solucion\u00f3 un problema de manejo de rutas con una validaci\u00f3n mejorada. Este problema se solucion\u00f3 en iOS 17.5 y iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Un acceso directo puede generar datos confidenciales del usuario sin consentimiento."
    }
  ],
  "id": "CVE-2024-27821",
  "lastModified": "2026-06-17T07:20:22.790",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-27821",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-29T17:36:34.101116Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-14T15:13:05.287",
  "references": [
    {
      "source": "product-security@apple.com",
      "url": "https://support.apple.com/en-us/120902"
    },
    {
      "source": "product-security@apple.com",
      "url": "https://support.apple.com/en-us/120903"
    },
    {
      "source": "product-security@apple.com",
      "url": "https://support.apple.com/en-us/120905"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://seclists.org/fulldisclosure/2024/May/10"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://seclists.org/fulldisclosure/2024/May/12"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://seclists.org/fulldisclosure/2024/May/16"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/HT214101"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/HT214104"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/HT214106"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/kb/HT214101"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/kb/HT214104"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/kb/HT214106"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-69WV-V57R-PJ37

Vulnerability from github – Published: 2024-05-14 15:32 – Updated: 2026-04-02 21:31

Details

A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A shortcut may output sensitive user data without consent.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-27821"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:13:05Z",
    "severity": "HIGH"
  },
  "details": "A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A shortcut may output sensitive user data without consent.",
  "id": "GHSA-69wv-v57r-pj37",
  "modified": "2026-04-02T21:31:39Z",
  "published": "2024-05-14T15:32:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27821"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120902"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120903"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120905"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214101"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214104"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT214106"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214101"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214104"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT214106"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/May/10"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/May/12"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/May/16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-27821

Vulnerability from gsd - Updated: 2024-02-27 06:02

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-27821

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-27821"
      ],
      "id": "GSD-2024-27821",
      "modified": "2024-02-27T06:02:31.440364Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-27821",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

NCSC-2024-0217

Vulnerability from csaf_ncscnl - Published: 2024-05-15 10:50 - Updated: 2024-05-15 11:18

Summary

Kwetsbaarheden verholpen in Apple MacOS

Scope

21 vulnerabilities in this advisory, including CVE-2024-27821.

CVE-2024-27821

Open the full advisory

NCSC-2024-0219

Vulnerability from csaf_ncscnl - Published: 2024-05-15 12:47 - Updated: 2024-05-15 12:47

Summary

Kwetsbaarheden verholpen in Apple iOS en iPadOS

Scope

14 vulnerabilities in this advisory, including CVE-2024-27821.

CVE-2024-27821

Open the full advisory

WID-SEC-W-2024-1097

Vulnerability from csaf_certbund - Published: 2024-05-13 22:00 - Updated: 2024-08-19 22:00

Summary

Apple iOS und iPadOS: Mehrere Schwachstellen

Severity

Hoch

Scope

48 vulnerabilities in this advisory, including CVE-2024-27821.

CVE-2024-27821

Es bestehen mehrere Schwachstellen in Apple iOS und Apple iPadOS. Diese Fehler bestehen in verschiedenen Komponenten wie dem AppleAVD, dem Kernel oder dem Libsystem, u. a. aufgrund mehrerer sicherheitsrelevanter Probleme wie einer unsachgemäßen Speicherbehandlung und Rechteverwaltung oder einer unzureichenden Validierung von Benutzereingaben und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, seine Privilegien zu erweitern oder vertrauliche Informationen offenzulegen. Einige der Schwachstellen erfordern eine Benutzerinteraktion für eine erfolgreiche Ausnutzung. .

Known affected: 2 products

Open the full advisory

WID-SEC-W-2024-1109

Vulnerability from csaf_certbund - Published: 2024-05-13 22:00 - Updated: 2024-11-21 23:00

Summary

Apple macOS: Mehrere Schwachstellen

Severity

Hoch

Scope

53 vulnerabilities in this advisory, including CVE-2024-27821.

CVE-2024-27821

Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten wie dem WebKit, der Sprachsteuerung oder dem Finder, unter anderem aufgrund mehrerer Probleme wie einer unsachgemäßen Speicherbehandlung oder einer unzureichenden Validierung von Benutzereingaben und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder vertrauliche Informationen offenzulegen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden.

Known affected: 3 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-27821 (GCVE-0-2024-27821)

Solution

Solution

BDU:2024-10239 (CVE-2024-27821)

Tags

Sightings

Nomenclature

Related by attack behaviour