{"id":"CVE-2025-24248","state":"PUBLISHED","title":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have signed into the user's ","description":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have signed into the user's Apple Account.","publishedAt":"2025-03-31T22:23:42.649Z","updatedAt":"2026-04-02T18:21:11.980Z","severity":{"score":5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"apple","products":["Apple macOS"],"affected":[{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"15.4","versionType":"custom"}]}],"references":["https://support.apple.com/en-us/122373","http://seclists.org/fulldisclosure/2025/Apr/8"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/24xxx/CVE-2025-24248.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-24248","state":"PUBLISHED","datePublished":"2025-03-31T22:23:42.649Z","dateUpdated":"2026-04-02T18:21:11.980Z","assignerShortName":"apple","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateReserved":"2025-01-17T00:00:45.009Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have signed into the user's Apple Account."}],"affected":[{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"15.4","versionType":"custom"}]}],"references":[{"url":"https://support.apple.com/en-us/122373"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"An app may be able to enumerate devices that have signed into the user's Apple Account"}]}],"providerMetadata":{"shortName":"apple","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateUpdated":"2026-04-02T18:21:11.980Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-01T18:20:32.327419Z","id":"CVE-2025-24248","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-01T18:21:31.839Z"}},{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2025/Apr/8"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T21:10:52.312Z"}}]}}}