CVE-2024-23262

This issue was addressed with additional entitlement checks. This issue is fixed in visionOS 1.1, iOS 17.4 and iPadOS 17.4, iOS 16.7.6 and iPadOS 16.7.6. An app may be able to spoof system notifications and UI.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://seclists.org/fulldisclosure/2024/Mar/26	Mailing List
https://support.apple.com/en-us/HT214081	Vendor Advisory
https://support.apple.com/en-us/HT214082	Vendor Advisory
https://support.apple.com/en-us/HT214087	Vendor Advisory
http://seclists.org/fulldisclosure/2024/Mar/26	Mailing List
https://support.apple.com/en-us/HT214081	Vendor Advisory
https://support.apple.com/en-us/HT214082	Vendor Advisory
https://support.apple.com/en-us/HT214087	Vendor Advisory
https://support.apple.com/kb/HT214081
https://support.apple.com/kb/HT214082
https://support.apple.com/kb/HT214087

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:visionos::::::::

History

04 Nov 2025, 19:16

Type	Values Removed	Values Added
References		() https://support.apple.com/kb/HT214081 - () https://support.apple.com/kb/HT214082 - () https://support.apple.com/kb/HT214087 -

Information

Published : 2024-03-08 02:15

Updated : 2025-11-04 19:16

NVD link : CVE-2024-23262

Mitre link : CVE-2024-23262

CVE.ORG link : CVE-2024-23262

JSON object : View

Products Affected

apple

visionos
iphone_os
ipados

CWE

NVD-CWE-noinfo CWE-863

Incorrect Authorization

{"id": "CVE-2024-23262", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-03-08T02:15:48.937", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Mar/26", "tags": ["Mailing List"], "source": "[email protected]"}, {"url": "https://support.apple.com/en-us/HT214081", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://support.apple.com/en-us/HT214082", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://support.apple.com/en-us/HT214087", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/26", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/en-us/HT214081", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/en-us/HT214082", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/en-us/HT214087", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT214081", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT214082", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT214087", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed with additional entitlement checks. This issue is fixed in visionOS 1.1, iOS 17.4 and iPadOS 17.4, iOS 16.7.6 and iPadOS 16.7.6. An app may be able to spoof system notifications and UI."}, {"lang": "es", "value": "Este problema se solucion\u00f3 con comprobaciones de derechos adicionales. Este problema se solucion\u00f3 en visionOS 1.1, iOS 17.4 y iPadOS 17.4, iOS 16.7.6 y iPadOS 16.7.6. Es posible que una aplicaci\u00f3n pueda falsificar las notificaciones del sistema y la interfaz de usuario."}], "lastModified": "2025-11-04T19:16:43.850", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9277B3E8-4519-4E07-A89A-A08C604AB78C", "versionEndExcluding": "16.7.6"}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CB78D53-5EC0-45E5-871B-0C18F1E6D438", "versionEndExcluding": "17.4", "versionStartIncluding": "17.0"}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AF8B925-3DE5-4CC8-A4C3-95D8F107D607", "versionEndExcluding": "16.7.6"}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2FE8515-300C-4B6F-92A0-7D1E6D93F907", "versionEndExcluding": "17.4", "versionStartIncluding": "17.0"}, {"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB7F6CDA-FEC0-45D7-ACBE-8B5AD35F1AB5", "versionEndExcluding": "1.1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}