CVE-2024-44133

Published Sep 17, 2024

Last updated 9 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-44133, codenamed "HM Surf" by Microsoft, is an authorization bypass vulnerability discovered in Apple macOS. This flaw specifically impacts the Transparency, Consent, and Control (TCC) framework, which is designed to manage user privacy preferences. The vulnerability allows an application to bypass certain privacy preferences on devices managed through Mobile Device Management (MDM). Exploitation of CVE-2024-44133 could lead to unauthorized access to sensitive user data, such as browsing history, location, camera, and microphone information, without explicit user consent. This is achieved by manipulating TCC protections within the Safari browser directory and local configuration files, including modifications to `PerSitePreferences`. Apple addressed this issue by removing the vulnerable code in macOS Sequoia 15.

Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15. On MDM managed devices, an app may be able to bypass certain Privacy preferences.
Source: product-security@apple.com
NVD status: Modified
Products: macos

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E8017C16-A17E-4AE7-9A0B-1295200A3A45",
            "versionEndExcluding": "15.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.