CVE-2024-40817 - Improper Restriction of Rendered UI Layers or Frames

Severity

61%

Complexity

27%

Confidentiality

45%

The issue was addressed with improved UI handling. This issue is fixed in macOS Sonoma 14.6, Safari 17.6, macOS Monterey 12.7.6, macOS Ventura 13.6.8. Visiting a website that frames malicious content may lead to UI spoofing.

CVSS 3.1 Base Score 6.1. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Overview

First reported 6 months ago

2024-07-29 23:15:00

Last updated 3 months ago

2024-11-21 09:31:00

Affected Software

Apple Safari

References

https://support.apple.com/en-us/HT214121

https://support.apple.com/en-us/HT214120

https://support.apple.com/en-us/HT214119

https://support.apple.com/en-us/HT214118

https://support.apple.com/kb/HT214121

http://seclists.org/fulldisclosure/2024/Jul/15

http://seclists.org/fulldisclosure/2024/Jul/20

http://seclists.org/fulldisclosure/2024/Jul/18

http://seclists.org/fulldisclosure/2024/Jul/19

https://support.apple.com/en-us/HT214121

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT214120

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT214119

Release Notes, Vendor Advisory

https://support.apple.com/en-us/HT214118

Release Notes, Vendor Advisory

https://support.apple.com/kb/HT214121

Release Notes, Vendor Advisory

http://seclists.org/fulldisclosure/2024/Jul/15

Mailing List, Third Party Advisory

http://seclists.org/fulldisclosure/2024/Jul/20

Mailing List, Third Party Advisory

http://seclists.org/fulldisclosure/2024/Jul/18

Mailing List, Third Party Advisory

http://seclists.org/fulldisclosure/2024/Jul/19

Mailing List, Third Party Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.