Visionos
CVE-2024-23295
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
A permissions issue was addressed to help ensure Personas are always protected. This issue is fixed in visionOS 1.1. An unauthenticated user may be able to use an unprotected Persona.
AnalysisAI
A permissions issue was addressed to help ensure Personas are always protected. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. A permissions issue was addressed to help ensure Personas are always protected. This issue is fixed in visionOS 1.1. An unauthenticated user may be able to use an unprotected Persona. Affected products include: Apple Visionos.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
The issue was addressed with improved memory handling. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
Out-of-bounds write vulnerability in WebKit across Apple's entire operating system ecosystem allows remote code executio
Unauthenticated access to Hidden Photos Album in Apple iOS, iPadOS, macOS, and visionOS allows remote attackers to view
An issue in the handling of URL protocols was addressed with improved logic. Rated critical severity (CVSS 9.3), this vu
An integer overflow was addressed with improved input validation. Rated high severity (CVSS 8.8), this vulnerability is
Memory handling flaws in Apple's operating systems allow unauthenticated remote attackers to cause information disclosur
The issue was addressed with improved bounds checks. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today