PT-2025-5285 · Apple · Apple Macos

Published 2025-01-27 · Updated 2025-01-29 · CVE-2025-24108

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 15.3

Description The issue is related to the insecure storage of confidential information in macOS, allowing an attacker to gain unauthorized access to protected data. An access issue was addressed with additional sandbox restrictions, which could enable an app to access protected user data.

Recommendations For macOS versions prior to 15.3, update to macOS Sequoia 15.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until the update is applied.

Fix

Missing Authorization

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-862

CWE-922

Related Identifiers

BDU:2025-01388

CVE-2025-24108

Affected Products

Apple Macos

References · 8

• https://osv.dev/vulnerability/CVE-2025-24108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24108 · Security Note
• https://support.apple.com/en-us/122068 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01388 · Security Note
• https://twitter.com/CVEnew/status/1884008898467922241 · Twitter Post
• https://reddit.com/r/k12cybersecurity/comments/1ictyj0/msisac_cybersecurity_advisory_multiple · Reddit Post
• http://seclists.org/fulldisclosure/2025/Jan/15 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24108 · Note