Skip to content
Fencer Vulns
medium 6.3

CVE-2024-44309 kev in the critical feed json

A cookie management issue was addressed with improved state management.

published 2024-11-19 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-41208

cvss
6.3
version 3.1, CNA
cisa kev
Exploited
added 2024-11-21
epss
21.9%
EPSS 21.9% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  • Apple Safari 18.1, 18.1.1
  • Apple iOS and iPadOS 17.7.2, 18.1.1
  • Apple macOS 15.1, 15.1.1
  • Apple visionOS 2.1, 2.1.1
  • apple iphone_os 17.7, 18.1
  • apple ipad_os 17.7, 18.1
  • wpewebkit Debian 14, Debian 13 2.46.4-1
  • webkit2gtk Debian 12 2.46.4-1~deb12u1
  • webkit2gtk Debian 14, Debian 13 2.46.4-1

debian advisories DEBIAN-CVE-2024-44309

  • webkit2gtk Ubuntu 22.04 LTS 2.46.4-0ubuntu0.22.04.1
  • webkit2gtk Ubuntu 24.04 LTS 2.46.4-0ubuntu0.24.04.1

ubuntu advisories UBUNTU-CVE-2024-44309

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • webkit2gtk3 RHEL 8 2.46.3-2.el8_10
  • webkit2gtk3-jsc RHEL 8 2.46.3-2.el8_10
  • webkit2gtk3 RHEL 9 2.46.3-2.el9_5
  • webkit2gtk3-jsc RHEL 9 2.46.3-2.el9_5
  • webkitgtk4 RHEL 7 ELS 2.48.3-2.el7_9
  • webkitgtk4-jsc RHEL 7 ELS 2.48.3-2.el7_9
  • webkit2gtk3 RHEL 9.0 E4S 2.46.3-2.el9_0
  • webkit2gtk3-jsc RHEL 9.0 E4S 2.46.3-2.el9_0

red hat advisories RHSA-2025:10364RHSA-2024:10496RHSA-2024:10482RHSA-2024:10489RHSA-2024:10480RHSA-2024:10481

  • webkit2gtk3 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.46.5-150400.4.103.1
  • webkit2gtk4 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.46.5-150400.4.103.1
  • webkit2gtk3-soup2 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 2.46.5-150400.4.103.1
  • webkit2gtk3 SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 2.46.5-150600.12.24.1
  • webkit2gtk4 SLE Module for Development Tools 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.46.5-150600.12.24.1
  • webkit2gtk3-soup2 SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.46.5-150600.12.24.1
  • webkit2gtk3 SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 2.46.3-150600.12.21.1
  • webkit2gtk4 SLE Module for Development Tools 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.46.3-150600.12.21.1

suse advisories SUSE-SU-2025:0104-1SUSE-SU-2025:0096-1SUSE-SU-2025:0043-1SUSE-SU-2024:4293-1SUSE-SU-2024:4292-1SUSE-SU-2024:4167-1

  • webkit2gtk3 AlmaLinux 9 2.46.3-2.el9_5
  • webkit2gtk3-jsc AlmaLinux 9 2.46.3-2.el9_5
  • webkit2gtk3 AlmaLinux 8 2.46.3-2.el8_10
  • webkit2gtk3-jsc AlmaLinux 8 2.46.3-2.el8_10

almalinux advisories ALSA-2024:10472ALSA-2024:10481

  • webkit2gtk3 Rocky Linux 8 2.46.3-2.el8_10

rocky linux advisories RLSA-2024:10481

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-44309 updated cvss 6.1

webkitgtk: data isolation bypass vulnerability

  • Red Hat Enterprise Linux 6 webkitgtk Red Hat Enterprise Linux 7 webkitgtk3, libwebkit2gtk
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3 2.46.3-2.el8_10, webkit2gtk3-jsc 2.46.3-2.el8_10
    fixed: vendor fix RHSA-2024:10481
  • Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3 2.46.3-2.el9_5, webkit2gtk3-jsc 2.46.3-2.el9_5
    fixed: vendor fix RHSA-2024:10472
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) webkit2gtk3 2.46.3-2.el8_2, webkit2gtk3-jsc 2.46.3-2.el8_2
    fixed: vendor fix RHSA-2024:10480
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) webkit2gtk3 2.46.3-2.el8_4, webkit2gtk3-jsc 2.46.3-2.el8_4
    fixed: vendor fix RHSA-2024:10501
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) webkit2gtk3 2.46.3-2.el8_6, webkit2gtk3-jsc 2.46.3-2.el8_6
    fixed: vendor fix RHSA-2024:10489
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) webkit2gtk3 2.46.3-2.el8_4, webkit2gtk3-jsc 2.46.3-2.el8_4
    fixed: vendor fix RHSA-2024:10501
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) webkit2gtk3 2.46.3-2.el8_6, webkit2gtk3-jsc 2.46.3-2.el8_6
    fixed: vendor fix RHSA-2024:10489
show 7 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) webkit2gtk3 2.46.3-2.el9_0, webkit2gtk3-jsc 2.46.3-2.el9_0
    fixed: vendor fix RHSA-2024:10496
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) webkit2gtk3 2.46.3-2.el8_8, webkit2gtk3-jsc 2.46.3-2.el8_8
    fixed: vendor fix RHSA-2024:10492
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) webkit2gtk3 2.46.3-2.el9_2, webkit2gtk3-jsc 2.46.3-2.el9_2
    fixed: vendor fix RHSA-2024:10482
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) webkit2gtk3 2.46.3-2.el9_4, webkit2gtk3-jsc 2.46.3-2.el9_4
    fixed: vendor fix RHSA-2024:10483
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) webkit2gtk3 2.46.3-2.el8_4, webkit2gtk3-jsc 2.46.3-2.el8_4
    fixed: vendor fix RHSA-2024:10501
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) webkit2gtk3 2.46.3-2.el8_6, webkit2gtk3-jsc 2.46.3-2.el8_6
    fixed: vendor fix RHSA-2024:10489
  • Red Hat Enterprise Linux Server (v. 7 ELS) webkitgtk4 2.48.3-2.el7_9, webkitgtk4-jsc 2.48.3-2.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) webkitgtk4-doc 2.48.3-2.el7_9, webkitgtk4-devel 2.48.3-2.el7_9, webkitgtk4-debuginfo 2.48.3-2.el7_9, webkitgtk4-jsc-devel 2.48.3-2.el7_9
    fixed: vendor fix RHSA-2025:10364

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. 0-day patched (Project Zero)
  2. Published
  3. Added to CISA KEV
  4. CISA SSVC: exploitation active
  5. CISA patch deadline

Known exploited

Added
23 mo ago
Patch by
2024-12-12 (22 mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product
Apple, Multiple Products
CISA name
Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched
2024-11-19
Details
project zero tracker

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

21.95% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
NVD 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CNA 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected products

  • Apple Safari
  • Apple iOS and iPadOS
  • Apple macOS
  • Apple visionOS
  • apple iphone_os
  • apple ipad_os

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.