CVE-2024-44309: Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability
CVE-2024-44309 · Severity: critical · CVSS 6.3 · Exploited in the wild · Published 2024-11-21
A cookie management issue in Apple's WebKit engine allows for cross-site scripting (XSS) when processing maliciously crafted web content. The vulnerability was addressed through improved state management across multiple Apple operating systems.
Yes. CVE-2024-44309 is known to be exploited in the wild, first recorded on 21 November 2024. Treat it as urgent.
How severe is CVE-2024-44309?
Critical severity, with a CVSS score of 6.3, published 21 November 2024.
Which products and versions are affected?
Apple Safari < 18.1.1; Apple iOS and iPadOS < 17.7.2, 18.0 to < 18.1.1; Apple macOS Sequoia 15.0 to < 15.1.1; Apple visionOS < 2.1.1.
Is there a fix for CVE-2024-44309?
A patch was published on 2024-11-21: Fixed in Safari 18.1.1, iOS 17.7.2/18.1.1, macOS 15.1.1, and visionOS 2.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-44309 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2024-44309?
Check whether you run Apple Multiple Products. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Apple Safari < 18.1.1
Apple iOS and iPadOS < 17.7.2, 18.0 to < 18.1.1
Apple macOS Sequoia 15.0 to < 15.1.1
Apple visionOS < 2.1.1
Timeline
2024-11-21: disclosed
2024-11-21: kev added: CISA added to Known Exploited Vulnerabilities catalog.
2024-11-21: exploited: Apple reported awareness of active exploitation on Intel-based Mac systems.
2024-11-21: patched: Fixed in Safari 18.1.1, iOS 17.7.2/18.1.1, macOS 15.1.1, and visionOS 2.1.1.