CVE-2024-23255

An authentication issue was addressed with improved state management. This issue is fixed in...

2.4 Low

An authentication issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Photos in the Hidden Photos Album may be viewed without authentication.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.67%Up 0.6 points since Mar 8, 2024

What each source reports

NVD Score used 2.4

Record: CVE-2024-23255
CVSS 3.1: 2.4 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287, CWE-863
Updated: 2026-11-02

CVE List 9.1

Record: CVE-2024-23255
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2024-20774 9.1

Record: EUVD-2024-20774
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7523-56gq-473q 9.1

An authentication issue was addressed with improved state management. This issue is fixed in...

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. Photos in the Hidden Photos Album may be viewed without authentication.

Record: GHSA-7523-56gq-473q
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287, CWE-863
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-23255 is a low vulnerability (CVSS 2.4) in Apple Ios, published March 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. No source names a fixed version.