CVE-2024-40857
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
17/09/2024
Last modified:
18/03/2025
Description
This issue was addressed through improved state management. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content may lead to universal cross site scripting.
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | 18.0 (excluding) | |
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | 18.0 (excluding) | |
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | 18.0 (excluding) | |
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | 15.0 (excluding) | |
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | 18.0 (excluding) | |
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* | 2.0 (excluding) | |
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | 11.0 (excluding) |
To consult the complete list of CPE names with products and versions, see this page