CVE-2024-54467

MEDIUM

Safari < 18 - Unauthorized Data Exfiltration via Cookie Management Issue

Title source: llm

Description

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.

References (7)

Core 7

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html

Release Notes, Vendor Advisory

https://support.apple.com/en-us/121238

Release Notes, Vendor Advisory

https://support.apple.com/en-us/121240

Release Notes, Vendor Advisory

https://support.apple.com/en-us/121241

Release Notes, Vendor Advisory

https://support.apple.com/en-us/121248

Release Notes, Vendor Advisory

https://support.apple.com/en-us/121249

Release Notes, Vendor Advisory

https://support.apple.com/en-us/121250

Scores

CVSS v3 6.5

EPSS 0.0012

EPSS Percentile 30.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (12)

Apple/iOS and iPadOS < 18

apple/ipados < 18.0

apple/iphone_os < 18.0

Apple/macOS < 15

apple/macos < 15.0

Apple/Safari < 18

apple/safari < 18.0

Apple/tvOS < 18

apple/tvos < 18.0

Apple/visionOS < 2

... and 2 more

Published Mar 10, 2025

Tracked Since Feb 18, 2026