#VU82409 State Issues in Apple iOS and iPadOS - CVE-2023-40408

Vulnerability identifier: #VU82409

Vulnerability risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-40408

CWE-ID: CWE-371

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Apple iOS
Operating systems & Components / Operating system
iPadOS
Operating systems & Components / Operating system

Vendor: Apple Inc.

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an inconsistent user interface issue in My Drafts feature, which can unexpectedly deactivate the Hide My Email option. A remote attacker can gain access to potentially sensitive information.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Apple iOS: 16.0 20A362 - 16.7.1 20H30

iPadOS: 16.0 20A362 - 16.7.1

---

External links
https://support.apple.com/en-us/HT213981

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.