Input validation error in WebKitGTK+ and WPE WebKit - CVE-2024-44206

Vulnerability identifier: #VU98744

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-44206

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of URL in WebKit. A remote attacker can trick the victim into clicking on a specially crafted link and bypass certain content restrictions.

WebKitGTK+
WPE WebKit
visionOS
watchOS
macOS
iPadOS
tvOS
Apple iOS
Apple Safari

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

visionOS - update to 1.3
watchOS - update to 10.6
macOS - update to 14.6 23G80
iPadOS - update to 17.6 21G80
Apple Safari - update to 17.6
tvOS - update to 17.6
Apple iOS - update to 17.6 21G80

• https://support.apple.com/en-us/120911

• Security restrictions bypass in WebKitGTK+ and WPE WebKit
• Multiple vulnerabilities in Apple macOS Sonoma
• Multiple vulnerabilities in Apple Safari
• Multiple vulnerabilities in Apple iOS 17 and iPadOS 17
• Multiple vulnerabilities in Apple watchOS
• Multiple vulnerabilities in Apple tvOS
• Multiple vulnerabilities in Apple visionOS