CVE-2023-40528

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An app may be able to bypass Privacy preferences.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Apple	iOS and iPadOS	>= unspecified, < 17
Apple	macOS	>= unspecified, < 13.6
Apple	tvOS	>= unspecified, < 17
Apple	macOS	>= unspecified, < 14
Apple	watchOS	>= unspecified, < 10

References

http://seclists.org/fulldisclosure/2024/Jan/37Third Party Advisory
https://support.apple.com/en-us/HT213936Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213937Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213938Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213940Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT214058Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213936Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213937Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213938Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213940Release Notes, Vendor Advisory
http://seclists.org/fulldisclosure/2024/Jan/37Third Party Advisory
https://support.apple.com/en-us/HT213936Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213937Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213938Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213940Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT214058Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213936Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213937Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213938Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213940Release Notes, Vendor Advisory
https://support.apple.com/kb/HT214058

Timeline

Published: Jan 23, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-405292.4This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17 and iPadOS 17. A person with physic CVE-2023-40536.5A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL CVE-2023-405304.7Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2 CVE-2023-405318.0Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to exe CVE-2023-405324.3Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial in CVE-2023-405347.5When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event CVE-2023-405355.4Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inj CVE-2023-405364.3Race condition for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to po CVE-2023-405378.1An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a mult CVE-2023-40545.5When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on CVE-2023-405404.4Non-Transparent Sharing of Microarchitectural Resources in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable CVE-2023-405415.5This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14. A shortcut may output sens