CVE-2024-23217
Apple Ipados ≤ 17.3
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NSummary
CVE-2024-23217 is a low-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Apple Ipados. Its CVSS base score is 3.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Stealth (T1211); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-20736
Vulnerability Data
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6.5, watchOS 10.3. An app may be able to bypass certain Privacy preferences.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2024-23217 enables apps to bypass macOS/iOS Privacy preferences (TCC controls) through improper temporary file handling in Shortcuts, facilitating exploitation for defense evasion (T1211) and TCC-related access abuse (T1548.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 2 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Tracking information locations and access supports secure storage practices instead of insecure ones.
Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.
Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.
Policy explicitly addresses insecure storage of CUI on external systems, requiring compliant handling and protections.
Proper categorization drives selection of storage controls that keep sensitive information from being stored insecurely.
The control explicitly requires secure storage mechanisms for sensitive information, closing the insecure-storage weakness class.
Storing information as fragments on distinct components is an architectural control that avoids insecure single-location storage of the complete sensitive data set.
OPSEC requirements improve handling and storage practices for sensitive supply-chain information.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure reuse and disposal procedures, including cryptographic wiping and physical destruction, stop the insecure storage of sensitive data on media that may later be accessed by unauthorized actors.
Mandating secure disposal techniques stops the insecure retention of sensitive information on storage media that leaves organizational control.