{"id":"CVE-2023-32391","aliases":["EUVD-2023-36635","GHSA-2jwp-cgrg-xr5p"],"status":"published","title":"The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5,...","description":"The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, watchOS 9.5, iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4. A shortcut may be able to use sensitive data with certain actions without prompting the user.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00333,"percentile":0.26735,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2023-06-23T00:00:00Z","modified":"2026-06-17T05:58:44Z","products":[{"vendor":"apple","product":"ios and ipados"},{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"macos"},{"vendor":"apple","product":"watchos"}],"references":[{"url":"https://support.apple.com/en-us/HT213758","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213764","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213765","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT213757","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/kb/HT213761","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32391"},{"url":"https://github.com/advisories/GHSA-2jwp-cgrg-xr5p"}],"sources":{"cve":[{"id":"CVE-2023-32391","description":"The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, watchOS 9.5, iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4. A shortcut may be able to use sensitive data with certain actions without prompting the user.","status":"published","published":"2023-06-23T00:00:00Z","modified":"2025-02-13T16:50:56.744Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-36635","description":"The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, watchOS 9.5, iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4. A shortcut may be able to use sensitive data with certain actions without prompting the user.","status":"published","published":"2023-06-23T00:00:00Z","modified":"2025-02-13T16:50:56Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"none"}],"updated_at":"2026-11-03T00:03:50.427692Z"}],"ghsa":[{"id":"GHSA-2jwp-cgrg-xr5p","title":"The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5,...","description":"The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4, watchOS 9.5, iOS 15.7.6 and iPadOS 15.7.6. A shortcut may be able to use sensitive data with certain actions without prompting the user","status":"published","published":"2023-06-23T18:30:25Z","modified":"2024-12-05T18:31:02Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:59:03.217136Z"}],"nvd":[{"id":"CVE-2023-32391","description":"The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, watchOS 9.5, iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4. A shortcut may be able to use sensitive data with certain actions without prompting the user.","status":"published","published":"2023-06-23T18:15:12.557Z","modified":"2026-06-17T05:58:44.637Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:08:12.414559Z"}]}}