VulnerableCode Vulnerability Details

Search for vulnerabilities

Vulnerability details: VCID-k497-wadu-aaag

Essentials
Severities (105)
References (18)
Severity details (19)
Exploits (1)
EPSS
History (0)

Vulnerability ID	VCID-k497-wadu-aaag
Aliases	CVE-2023-32409
Summary	The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
Status	Published
Exploitability	2.0
Weighted Severity	7.9
Risk	10.0
Affected and Fixed Packages	Package Details

Weaknesses (1)

CWE-693

Protection Mechanism Failure

System	Score	Found at
cvssv3	8.8	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32409.json
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00306	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00313	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00354	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00354	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.00354	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01437	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01437	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01437	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01437	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01708	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01708	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01708	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01708	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01708	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01708	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01708	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.01988	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02037	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02037	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02037	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.02049	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
epss	0.07	https://api.first.org/data/v1/epss?cve=CVE-2023-32409
cvssv3	8.6	https://nvd.nist.gov/vuln/detail/CVE-2023-32409
cvssv3.1	8.6	https://nvd.nist.gov/vuln/detail/CVE-2023-32409
ssvc	Attend	https://support.apple.com/en-us/HT213757
ssvc	Track	https://support.apple.com/en-us/HT213757
ssvc	Attend	https://support.apple.com/en-us/HT213758
ssvc	Attend	https://support.apple.com/en-us/HT213758
ssvc	Track	https://support.apple.com/en-us/HT213758
ssvc	Attend	https://support.apple.com/en-us/HT213761
ssvc	Track	https://support.apple.com/en-us/HT213761
ssvc	Attend	https://support.apple.com/en-us/HT213762
ssvc	Attend	https://support.apple.com/en-us/HT213762
ssvc	Track	https://support.apple.com/en-us/HT213762
ssvc	Attend	https://support.apple.com/en-us/HT213764
ssvc	Attend	https://support.apple.com/en-us/HT213764
ssvc	Track	https://support.apple.com/en-us/HT213764
ssvc	Attend	https://support.apple.com/en-us/HT213842
ssvc	Attend	https://support.apple.com/en-us/HT213842
ssvc	Track	https://support.apple.com/en-us/HT213842

Reference id	Reference type	URL
		https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32409.json
		https://api.first.org/data/v1/epss?cve=CVE-2023-32409
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32409
		http://seclists.org/fulldisclosure/2023/Jul/46
		https://support.apple.com/en-us/HT213757
		https://support.apple.com/en-us/HT213758
		https://support.apple.com/en-us/HT213761
		https://support.apple.com/en-us/HT213762
		https://support.apple.com/en-us/HT213764
		https://support.apple.com/en-us/HT213842
2209204		https://bugzilla.redhat.com/show_bug.cgi?id=2209204
cpe:2.3:a:apple:safari::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:safari::::::::
cpe:2.3:o:apple:ipados::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:ipados::::::::
cpe:2.3:o:apple:iphone_os::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:iphone_os::::::::
cpe:2.3:o:apple:macos::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:macos::::::::
cpe:2.3:o:apple:tvos::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:tvos::::::::
cpe:2.3:o:apple:watchos::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:watchos::::::::
CVE-2023-32409		https://nvd.nist.gov/vuln/detail/CVE-2023-32409

Data source	KEV
Date added	May 22, 2023
Description	Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action	Apply updates per vendor instructions.
Due date	June 12, 2023
Note	https://support.apple.com/HT213757, https://support.apple.com/HT213758, https://support.apple.com/HT213761, https://support.apple.com/HT213762, https://support.apple.com/HT213764, https://support.apple.com/HT213765; https://nvd.nist.gov/vuln/detail/CVE-2023-32409
Ransomware campaign use	Unknown

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32409.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-32409

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-32409

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213757

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-17T15:16:31Z/ Found at https://support.apple.com/en-us/HT213757

Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213758

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-17T15:16:31Z/ Found at https://support.apple.com/en-us/HT213758

Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213761

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-17T15:16:31Z/ Found at https://support.apple.com/en-us/HT213761

Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213762

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-17T15:16:31Z/ Found at https://support.apple.com/en-us/HT213762

Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213764

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-17T15:16:31Z/ Found at https://support.apple.com/en-us/HT213764

Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-01-27T22:14:51Z/ Found at https://support.apple.com/en-us/HT213842

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-17T15:16:31Z/ Found at https://support.apple.com/en-us/HT213842

Exploit Prediction Scoring System (EPSS)

Percentile	0.53076
EPSS Score	0.00306
Published At	April 15, 2025, 12:55 p.m.

Date	Actor	Action	Source	VulnerableCode Version
There are no relevant records.