Sensitive User Data Exposure in Apple iOS and iPadOS
CVE-2023-40394

3.3LOW

Key Information:

Vendor

Apple
Status
iOS and iPadOS
Vendor
CVE Published:
10 January 2024

What is CVE-2023-40394?

An issue identified in Apple's iOS and iPadOS allows applications to potentially access sensitive user data due to inadequate validation of environment variables. This vulnerability, which has been addressed starting from iOS 16.6 and iPadOS 16.6, highlights the importance of stringent security measures to safeguard user privacy. Users are encouraged to update their devices to the latest versions to mitigate any risk of data exposure.

Affected Version(s)

iOS and iPadOS < 16.6

References

https://support.apple.com/en-us/HT213841

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.