{"id":"CVE-2024-40794","state":"PUBLISHED","title":"This issue was addressed through improved state management. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Private Browsing tabs may be accessed w","description":"This issue was addressed through improved state management. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Private Browsing tabs may be accessed without authentication.","publishedAt":"2024-07-29T22:17:20.010Z","updatedAt":"2026-04-02T18:26:18.702Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"CISA-ADP"},"assigner":"apple","products":["Apple Safari","Apple iOS and iPadOS","Apple macOS"],"affected":[{"vendor":"Apple","product":"Safari","versions":[{"version":"0","status":"affected","lessThan":"17.6","versionType":"custom"}]},{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","status":"affected","lessThan":"17.6","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"14.6","versionType":"custom"}]}],"references":["https://support.apple.com/en-us/120909","https://support.apple.com/en-us/120911","https://support.apple.com/en-us/120913","https://support.apple.com/en-us/HT214121","https://support.apple.com/en-us/HT214117","https://support.apple.com/en-us/HT214119","http://seclists.org/fulldisclosure/2024/Jul/16","http://seclists.org/fulldisclosure/2024/Jul/15","http://seclists.org/fulldisclosure/2024/Jul/18","https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html","https://support.apple.com/kb/HT214121","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214117"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/40xxx/CVE-2024-40794.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-40794","state":"PUBLISHED","datePublished":"2024-07-29T22:17:20.010Z","dateUpdated":"2026-04-02T18:26:18.702Z","assignerShortName":"apple","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateReserved":"2024-07-10T17:11:04.690Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"This issue was addressed through improved state management. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Private Browsing tabs may be accessed without authentication."}],"affected":[{"vendor":"Apple","product":"Safari","versions":[{"version":"0","status":"affected","lessThan":"17.6","versionType":"custom"}]},{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","status":"affected","lessThan":"17.6","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"14.6","versionType":"custom"}]}],"references":[{"url":"https://support.apple.com/en-us/120909"},{"url":"https://support.apple.com/en-us/120911"},{"url":"https://support.apple.com/en-us/120913"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Private Browsing tabs may be accessed without authentication"}]}],"providerMetadata":{"shortName":"apple","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateUpdated":"2026-04-02T18:26:18.702Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-07-30T18:46:28.390932Z","id":"CVE-2024-40794","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-14T18:21:02.523Z"}},{"title":"CVE Program Container","references":[{"url":"https://support.apple.com/en-us/HT214121","tags":["x_transferred"]},{"url":"https://support.apple.com/en-us/HT214117","tags":["x_transferred"]},{"url":"https://support.apple.com/en-us/HT214119","tags":["x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/16","tags":["x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/15","tags":["x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/18","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html"},{"url":"https://support.apple.com/kb/HT214121"},{"url":"https://support.apple.com/kb/HT214119"},{"url":"https://support.apple.com/kb/HT214117"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T17:24:09.623Z"}}]}}}