PT-2024-30973 · Apple · Ipados+3

Denis Tokarev + 1 · Published 2024-09-16 · Updated 2025-05-14 · CVE-2024-44131

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18 iPadOS versions prior to 18 macOS Sequoia versions prior to 15

Description This issue was addressed with improved validation of symlinks, allowing unauthorized apps to access sensitive user data, including Health information, microphone, and iCloud backups, without user consent or knowledge. The vulnerability affects the Transparency, Consent, and Control (TCC) subsystem, which is designed to protect sensitive data.

Recommendations Update to iOS 18 to fix the issue. Update to iPadOS 18 to fix the issue. Update to macOS Sequoia 15 to fix the issue.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2024-44131

Affected Products

Apple Macos

Ios

Ipados

Macos Sequoia

References · 40

• https://osv.dev/vulnerability/CVE-2024-44131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44131 · Security Note
• https://twitter.com/seaarepea/status/1867254940261040438 · Twitter Post
• https://twitter.com/bigwink87/status/1867673473562075416 · Twitter Post
• https://twitter.com/SalvadorCloud/status/1867479806452867480 · Twitter Post
• https://twitter.com/safeyourweb/status/1869664085400584651 · Twitter Post
• https://thehackernews.com/2024/12/researchers-uncover-symlink-exploit.html?m=1 · Reddit Post
• https://twitter.com/EHackerNews/status/1867249197327733118 · Twitter Post
• https://twitter.com/ShahriyarGourgi/status/1867213400184656240 · Twitter Post
• https://twitter.com/CRAC_Learning/status/1867804224139989103 · Twitter Post
• https://t.me/nekaspersky/4048 · Telegram Post
• https://twitter.com/apple_news_top/status/1866470837437743223 · Twitter Post
• https://twitter.com/cyb3rshi3ld/status/1909644979879686392 · Twitter Post
• https://twitter.com/CVEnew/status/1835828869493915947 · Twitter Post
• https://twitter.com/gbhackers_news/status/1867039735119745417 · Twitter Post