PT-2025-5330 · Apple · Safari+2
Josh Parnham
+1
·
Published
2025-01-27
·
Updated
2025-01-31
·
CVE-2025-24169
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
macOS Sequoia versions prior to 15.3
Safari versions prior to 18.3
Description
A logging issue was addressed with improved data redaction. This issue may allow a malicious app to bypass browser extension authentication. The vulnerability is related to the Passwords component of the Safari browser in macOS operating systems, which can lead to information disclosure through log files. A remote attacker may exploit this issue to bypass security restrictions.
Recommendations
For macOS Sequoia versions prior to 15.3, update to macOS Sequoia 15.3 to resolve the issue.
For Safari versions prior to 18.3, update to Safari 18.3 to resolve the issue.
As a temporary workaround, consider restricting access to the Passwords component of the Safari browser until a patch is available.
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apple Macos
Safari
Macos Sequoia