Vulnerability details
CVE-2023-41993
Actively exploited
Apple iPadOSApple iphone_osApple macOSDebian debian_linuxFedora Project fedoraNETAPP OnCommand Insight
CVSS 3.1
8.8High
Official description
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Apple | iPadOS | v < 17.0.1 | CISA ADP / Vulnrichment |
| Apple | iphone_os | v < 17.0.1 | CISA ADP / Vulnrichment |
| Apple | macOS | v < 14 | CVEProject cvelistV5 (CNA) |
| Apple | macOS | v < 14.0 | CISA ADP / Vulnrichment |
| Debian | debian_linux | 11.0 | CISA ADP / Vulnrichment |
| Debian | debian_linux | 11.0 | CISA ADP / Vulnrichment |
| Debian | debian_linux | 12.0 | CISA ADP / Vulnrichment |
| Debian | debian_linux | 12.0 | CISA ADP / Vulnrichment |
| Fedora Project | fedora | 37 | CISA ADP / Vulnrichment |
| Fedora Project | fedora | 38 | CISA ADP / Vulnrichment |
| Fedora Project | fedora | 39 | CISA ADP / Vulnrichment |
| NETAPP | OnCommand Insight | All | CISA ADP / Vulnrichment |
| NETAPP | OnCommand Workflow Automation | All | CISA ADP / Vulnrichment |
| NETAPP | cloud_insights_acquisition_unit | All | CISA ADP / Vulnrichment |
| NETAPP | cloud_insights_storage_workload_security_agent | All | CISA ADP / Vulnrichment |
| oracle | graalvm | 20.3.13 | CISA ADP / Vulnrichment |
| oracle | graalvm | 21.3.9 | CISA ADP / Vulnrichment |
| oracle | jdk | 1.8.0 | CISA ADP / Vulnrichment |
| oracle | jre | 1.8.0 | CISA ADP / Vulnrichment |
References and advisories
7- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41993 government-resource
- https://support.apple.com/en-us/HT213940
- https://security.gentoo.org/glsa/202401-33
- https://security.netapp.com/advisory/ntap-20240426-0004/
- https://webkitgtk.org/security/WSA-2023-0009.html
- https://support.apple.com/kb/HT213930
- https://support.apple.com/kb/HT213926
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2023-09-21
- Last updated
- 2025-11-04
- State
- Published
- Assigner (CNA)
- apple
- Kolun priority
- 88 · Critical
CISA KEV catalog
- Date added
- 2023-09-25
- Due date
- 2023-10-16
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
23.7%
Probability of exploitation in 30 days
97.8%
Percentile (among all CVEs)
- 2026-11-0723.7%
- 2026-11-0324.34%
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-754Improper Check for Unusual or Exceptional Conditions