{"id":"CVE-2024-44309","kind":"vulnerability","aliases":["CVE-2024-44309"],"related":[],"title":"A cookie management issue was addressed with improved state management","description":"A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.","summary":"Apple iOS, macOS and other Apple products mishandle maliciously crafted web content, enabling cross-site scripting. An attacker who gets a user to load that content can run script in the context of a site, which is listed as actively exploited in the wild.","severity":"medium","cvss":6.3,"epss":null,"exploited":true,"exploited_at":"2024-11-21T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"apple safari","fixed":["18.1.1"],"affected":"< 18.1.1","ecosystem":"vendor"},{"name":"apple ipados","fixed":["17.7.2"],"affected":"< 17.7.2","ecosystem":"vendor"},{"name":"apple ipados","fixed":["18.1.1"],"affected":">= 18.0, < 18.1.1","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["17.7.2"],"affected":"< 17.7.2","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["18.1.1"],"affected":">= 18.0, < 18.1.1","ecosystem":"vendor"},{"name":"apple macos","fixed":["15.1.1"],"affected":">= 15.0, < 15.1.1","ecosystem":"vendor"},{"name":"apple visionos","fixed":["2.1.1"],"affected":"< 2.1.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","ios","macos","safari","vendor","webkit"],"not_affected_if":["unknown"],"how_to_check":"Check the installed OS version under Settings > General > About (iOS) or Apple menu > About This Mac (macOS) against Apple's security release notes; the sources do not give a version list.","fix":"Update iOS, iPadOS, macOS and other Apple devices to the latest release, per the CISA required action to apply vendor mitigations.","status":"open","published_at":"2024-11-20T00:15:17+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:08+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-23T20:56:08Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS, macOS and other Apple devices to the latest release, per the CISA required action to apply vendor mitigations.\nunknown","reach":"internet","impact":"medium","summary":"Apple iOS, macOS and other Apple products mishandle maliciously crafted web content, enabling cross-site scripting. An attacker who gets a user to load that content can run script in the context of a site, which is listed as actively exploited in the wild.","category":"vendor","who_cares":["apple","ios","macos","safari","webkit"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker runs script in a victim's browsing context via crafted web content","analyst_note":"Find Apple's security advisory for CVE-2024-44309 to confirm affected versions, fixed builds and the exact component (likely WebKit) and whether the exploited-in-the-wild note has a patch date.","how_to_check":"Check the installed OS version under Settings > General > About (iOS) or Apple menu > About This Mac (macOS) against Apple's security release notes; the sources do not give a version list.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000502,"input_tokens":2831,"output_tokens":438,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':12A,15A '-44309':13A,16A '15.1.1':119C '17.7.2':108C,111C '18.1.1':106C,113C,116C '2.1.1':121C 'activ':85B,147C 'address':6A,95C 'appl':38B,45B,50B,135C 'apple':17A,22A,24A,26A,28A,31A,34A,36A 'attack':63B,134C 'awar':137C 'base':152C 'content':56B,71B,126C 'context':77B 'cooki':2A,91C 'craft':54B,124C 'cross':59B,131C 'cross-sit':58B 'cve':11A,14A 'debian':20A 'enabl':57B 'exploit':39B,86B,148C 'fix':103C 'get':65B 'improv':8A,97C 'intel':151C 'intel-bas':150C 'io':40B,46B,107C,112C 'ipado':110C,115C 'ipados':25A,27A 'iphone':29A,32A 'issu':4A,93C,101C,143C 'lead':128C 'linux':21A 'list':83B 'load':69B 'mac':153C 'maco':41B,47B,117C 'macos':35A 'malici':53B,123C 'manag':3A,10A,92C,99C 'may':127C,144C 'mishandl':52B 'multiple':18A 'os':30A,33A 'process':122C 'product':51B 'products':19A 'report':140C 'run':73B 'safari':23A,42B,105C 'script':61B,74B,133C 'sequoia':118C 'site':60B,80B,132C 'state':9A,98C 'system':154C 'user':67B 'vendor':43B 'visiono':120C 'visionos':37A 'web':55B,125C 'webkit':44B 'wild':89B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-11-20T00:15:17+00:00","kev":{"dateAdded":"2024-11-21","dueDate":"2024-12-12","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-44309","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-44309","severity":null,"published_at":"2024-11-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-44309","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44309","severity":null,"published_at":"2024-11-20T00:15:17+00:00","modified_at":"2026-06-17T07:52:45+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}