CVE-2024-44195

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/121564	Vendor Advisory
http://seclists.org/fulldisclosure/2024/Oct/11

Configurations

Configuration 1 (hide)

cpe:2.3:o:apple:macos:15.0:*:*:*:*:*:*:*

History

03 Nov 2025, 22:18

Type	Values Removed	Values Added
References		() http://seclists.org/fulldisclosure/2024/Oct/11 -

23 Jan 2025, 20:38

Type	Values Removed	Values Added
CPE		cpe:2.3:o:apple:macos:15.0:::::::*
References	~~() https://support.apple.com/en-us/121564 -~~	() https://support.apple.com/en-us/121564 - Vendor Advisory
Summary		(es) Se solucionó un problema de lógica mejorando la validación. Este problema se solucionó en macOS Sequoia 15.1. Es posible que una aplicación pueda leer archivos arbitrarios.
First Time		Apple Apple macos
CWE		NVD-CWE-noinfo

20 Dec 2024, 17:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CWE		CWE-22

20 Dec 2024, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-20 04:15

Updated : 2025-11-03 22:18

NVD link : CVE-2024-44195

Mitre link : CVE-2024-44195

CVE.ORG link : CVE-2024-44195

JSON object : View

Products Affected

apple

macos

CWE

NVD-CWE-noinfo CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-44195", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-12-20T04:15:05.313", "references": [{"url": "https://support.apple.com/en-us/121564", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "http://seclists.org/fulldisclosure/2024/Oct/11", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files."}, {"lang": "es", "value": "Se solucion\u00f3 un problema de l\u00f3gica mejorando la validaci\u00f3n. Este problema se solucion\u00f3 en macOS Sequoia 15.1. Es posible que una aplicaci\u00f3n pueda leer archivos arbitrarios."}], "lastModified": "2025-11-03T22:18:25.023", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3B4B03A-A23F-4431-BFAF-B52C14B2C0B9"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}