CVE-2024-27872

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

T

his issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protected user data.

References

Link	Resource
http://seclists.org/fulldisclosure/2024/Jul/18	Mailing List Third Party Advisory
https://support.apple.com/en-us/HT214119	Release Notes Vendor Advisory
http://seclists.org/fulldisclosure/2024/Jul/18	Mailing List Third Party Advisory
https://support.apple.com/en-us/HT214119	Release Notes Vendor Advisory
https://support.apple.com/kb/HT214119

Configurations

Configuration 1 (hide)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

History

04 Nov 2025, 18:16

Type	Values Removed	Values Added
References		() https://support.apple.com/kb/HT214119 -

14 Mar 2025, 19:15

Type	Values Removed	Values Added
CWE		CWE-61

21 Nov 2024, 09:05

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2024/Jul/18 - Mailing List, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2024/Jul/18 - Mailing List, Third Party Advisory
References	~~() https://support.apple.com/en-us/HT214119 - Release Notes, Vendor Advisory~~	() https://support.apple.com/en-us/HT214119 - Release Notes, Vendor Advisory

12 Aug 2024, 14:57

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-29 23:15

Updated : 2025-11-04 18:16

NVD link : CVE-2024-27872

Mitre link : CVE-2024-27872

CVE.ORG link : CVE-2024-27872

JSON object : View

Products Affected

macos

CWE

NVD-CWE-noinfo CWE-61

UNIX Symbolic Link (Symlink) Following

{"id": "CVE-2024-27872", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-07-29T23:15:10.557", "references": [{"url": "http://seclists.org/fulldisclosure/2024/Jul/18", "tags": ["Mailing List", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://support.apple.com/en-us/HT214119", "tags": ["Release Notes", "Vendor Advisory"], "source": "[email protected]"}, {"url": "http://seclists.org/fulldisclosure/2024/Jul/18", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/en-us/HT214119", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT214119", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-61"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protected user data."}, {"lang": "es", "value": " Este problema se solucion\u00f3 con una validaci\u00f3n mejorada de los enlaces simb\u00f3licos. Este problema se solucion\u00f3 en macOS Sonoma 14.6. Es posible que una aplicaci\u00f3n pueda acceder a datos de usuario protegidos."}], "lastModified": "2025-11-04T18:16:15.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "687902EF-637F-4537-B419-15A1695370B9", "versionEndExcluding": "14.6"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}