CVE-2024-40836 : A logic issue was addressed with improved checks. This issue is fixed in watchOS

A logic issue was addressed with improved checks. This issue is fixed in watchOS 10.6, macOS Sonoma 14.6, iOS 17.6 and iPadOS 17.6, iOS 16.7.9 and iPadOS 16.7.9. A shortcut may be able to use sensitive data with certain actions without prompting the user.

Published 2024-07-29 22:16:47

Updated 2025-03-13 20:15:22

Source Apple Inc.

View at NVD, CVE.org

Products affected by CVE-2024-40836

Apple » Iphone Os
Versions before (<) 16.7.9
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Matching versions
Apple » Iphone Os
Versions from including (>=) 17.0 and before (<) 17.6
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Matching versions
Apple » Watchos
Versions before (<) 10.6
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Matching versions
Apple » Macos
Versions from including (>=) 14.0 and before (<) 14.6
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Matching versions
Apple » Ipados
Versions before (<) 16.7.9
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Matching versions
Apple » Ipados
Versions from including (>=) 17.0 and before (<) 17.6
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2024-40836

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 40 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2024-40836

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-08-01
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST	2024-12-11
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2024-40836

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

References for CVE-2024-40836

https://support.apple.com/en-us/HT214124

About the security content of watchOS 10.6 - Apple Support
Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2024/Jul/16

Full Disclosure: APPLE-SA-07-29-2024-2 iOS 17.6 and iPadOS 17.6
Mailing List

CVEs referencing this url
https://support.apple.com/en-us/HT214119

About the security content of macOS Sonoma 14.6 - Apple Support
Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2024/Jul/21

Full Disclosure: APPLE-SA-07-29-2024-7 watchOS 10.6
Mailing List

CVEs referencing this url
https://support.apple.com/en-us/HT214116

About the security content of iOS 16.7.9 and iPadOS 16.7.9 - Apple Support
Vendor Advisory

CVEs referencing this url
https://support.apple.com/en-us/HT214117

About the security content of iOS 17.6 and iPadOS 17.6 - Apple Support
Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2024/Jul/18

Full Disclosure: APPLE-SA-07-29-2024-4 macOS Sonoma 14.6
Mailing List

CVEs referencing this url
http://seclists.org/fulldisclosure/2024/Jul/17

Full Disclosure: APPLE-SA-07-29-2024-3 iOS 16.7.9 and iPadOS 16.7.9
Mailing List

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2024-40836

Products affected by CVE-2024-40836

Exploit prediction scoring system (EPSS) score for CVE-2024-40836

CVSS scores for CVE-2024-40836

CWE ids for CVE-2024-40836

References for CVE-2024-40836