VulnerabilityModified
CVE-2024-44206
A user may be able to bypass some web content restrictions.
CRITICAL 9.3EPSS 0.46%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue in the handling of URL protocols was addressed with improved logic. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. A user may be able to bypass some web content restrictions.
- CVSS 3.1
- 9.3 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
- EPSS
- 0.46% probability · 38th percentile
- CISA KEV
- Not listed
- Affected
- apple/safari · apple/ipados · apple/iphone os · apple/macos · apple/tvos · apple/visionos
- Source
- product-security@apple.com
References
- https://support.apple.com/en-us/120909Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120911Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120913Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120914Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120915Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120916Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2024/Nov/6
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.