CVE-2025-24141

An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3. An attacker with physical access to an unlocked device may be able to access Photos while the app is locked.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/122066	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::

History

04 Feb 2025, 22:15

Type	Values Removed	Values Added
CWE		CWE-863

30 Jan 2025, 18:03

Type	Values Removed	Values Added
First Time		Apple iphone Os Apple Apple ipados
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 3.3
References	~~() https://support.apple.com/en-us/122066 -~~	() https://support.apple.com/en-us/122066 - Release Notes
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os::::::::
Summary		(es) Se solucionó un problema de autenticación con con una mejor gestión del estado. Este problema se solucionó en iOS 18.3 y iPadOS 18.3. Un atacante con acceso físico a un dispositivo desbloqueado podría acceder a Fotos mientras la aplicación está bloqueada.

27 Jan 2025, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-27 22:15

Updated : 2025-02-04 22:15

NVD link : CVE-2025-24141

Mitre link : CVE-2025-24141

CVE.ORG link : CVE-2025-24141

JSON object : View

Products Affected

apple

ipados
iphone_os

CWE

NVD-CWE-noinfo CWE-863

Incorrect Authorization

{"id": "CVE-2025-24141", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2025-01-27T22:15:18.800", "references": [{"url": "https://support.apple.com/en-us/122066", "tags": ["Release Notes"], "source": "product-security@apple.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3. An attacker with physical access to an unlocked device may be able to access Photos while the app is locked."}, {"lang": "es", "value": "Se solucion\u00f3 un problema de autenticaci\u00f3n con con una mejor gesti\u00f3n del estado. Este problema se solucion\u00f3 en iOS 18.3 y iPadOS 18.3. Un atacante con acceso f\u00edsico a un dispositivo desbloqueado podr\u00eda acceder a Fotos mientras la aplicaci\u00f3n est\u00e1 bloqueada."}], "lastModified": "2025-02-04T22:15:42.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B7F80FC-EB0A-4B78-8CB7-18E5F162CD6A", "versionEndExcluding": "18.3"}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71A94ACA-8143-475F-8A89-8020B86CE80B", "versionEndExcluding": "18.3"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}