CVE Vulnerabilities

CVE-2024-23280

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Mar 08, 2024 | Modified: Dec 07, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
6.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM
root.io minimus.io echohq.com

An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. A maliciously crafted webpage may be able to fingerprint the user.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Safari Apple * 17.4 (excluding)
Ipad_os Apple * 17.4 (excluding)
Iphone_os Apple * 17.4 (excluding)
Macos Apple 14.0 (including) 14.4 (excluding)
Tvos Apple * 17.4 (excluding)
Watchos Apple * 10.4 (excluding)
Red Hat Enterprise Linux 8 RedHat webkit2gtk3-0:2.46.3-2.el8_10 *
Red Hat Enterprise Linux 9 RedHat webkit2gtk3-0:2.46.1-2.el9_4 *
Qtwebkit-opensource-src Ubuntu devel *
Qtwebkit-opensource-src Ubuntu esm-apps/bionic *
Qtwebkit-opensource-src Ubuntu esm-apps/focal *
Qtwebkit-opensource-src Ubuntu esm-apps/jammy *
Qtwebkit-opensource-src Ubuntu esm-apps/noble *
Qtwebkit-opensource-src Ubuntu esm-infra/xenial *
Qtwebkit-opensource-src Ubuntu focal *
Qtwebkit-opensource-src Ubuntu jammy *
Qtwebkit-opensource-src Ubuntu mantic *
Qtwebkit-opensource-src Ubuntu noble *
Qtwebkit-opensource-src Ubuntu upstream *
Qtwebkit-source Ubuntu esm-apps/bionic *
Qtwebkit-source Ubuntu esm-apps/xenial *
Webkit2gtk Ubuntu esm-infra/bionic *
Webkit2gtk Ubuntu esm-infra/focal *
Webkit2gtk Ubuntu esm-infra/xenial *
Webkit2gtk Ubuntu focal *
Webkit2gtk Ubuntu jammy *
Webkit2gtk Ubuntu mantic *
Webkit2gtk Ubuntu upstream *
Webkitgtk Ubuntu esm-apps/bionic *
Webkitgtk Ubuntu esm-apps/xenial *
Wpewebkit Ubuntu esm-apps/focal *
Wpewebkit Ubuntu esm-apps/jammy *
Wpewebkit Ubuntu focal *
Wpewebkit Ubuntu jammy *

Potential Mitigations

References