CVE-2024-54535 - A path handling issue was addressed with improved logic

Back Back to CVE browser

MEDIUM

A path handling issue was addressed with improved logic

Published Jan 15, 2025

4.3

MEDIUM

CVSS 3.1

EPSS 0.45%

Description

A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An attacker with access to calendar data could also read reminders.

Affected products

Vendor Apple Product iOS and iPadOS Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <18.1
Vendor Apple Product macOS Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <15.1
Vendor Apple Product visionOS Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <2.1
Vendor Apple Product watchOS Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <11.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apple

iOS and iPadOS

n/a

Version	Status	Constraints
0	affected	<18.1

Apple

macOS

n/a

Version	Status	Constraints
0	affected	<15.1

Apple

visionOS

n/a

Version	Status	Constraints
0	affected	<2.1

Apple

watchOS

n/a

Version	Status	Constraints
0	affected	<11.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

https://support.apple.com/en-us/121563
Vendor Advisory
https://support.apple.com/en-us/121564
https://support.apple.com/en-us/121565
Vendor Advisory
https://support.apple.com/en-us/121566
Vendor Advisory

Link	Providers	Tags
https://support.apple.com/en-us/121563		Vendor Advisory
https://support.apple.com/en-us/121564
https://support.apple.com/en-us/121565		Vendor Advisory
https://support.apple.com/en-us/121566		Vendor Advisory