Cyber Resilience

CVE-2024-23204

High

Published: 23 January 2024

Published
23 January 2024
Modified
02 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0019 40.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-23204 is a high-severity an unspecified weakness vulnerability in Apple Ipados. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique TCC Manipulation (T1548.006); ranked at the 40.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, watchOS 10.3. A shortcut may be able to…

more

use sensitive data with certain actions without prompting the user.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1548.006 TCC Manipulation Privilege Escalation
Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.
attack.mitre.org →
Why these techniques?

CVE-2024-23204 in Shortcuts enables bypassing permission prompts to access sensitive user data without consent, facilitating abuse of macOS/iOS privacy controls analogous to TCC manipulation.

Affected Assets

apple
ipados
17.0 — 17.3
apple
iphone os
17.0 — 17.3
apple
macos
≤ 14.3
apple
watchos
≤ 10.3

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References