CVE-2022-46698 Information disclosure in iCloud for Windows

What is CVE-2022-46698?

CVE-2022-46698 is a medium-severity vulnerability in Apple Icloud, published on 15 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information.

Weakness: CWE-693

Which versions are affected by CVE-2022-46698?

It affects 7 products.

Products include Apple Icloud, Apple Ipados, Apple Iphone Os, Apple Macos, Apple Safari, Apple Tvos and 1 more.

How do I fix CVE-2022-46698?

Upgrade to a fixed version.

Is CVE-2022-46698 being exploited?

There is no known exploitation of CVE-2022-46698 in the wild and no public exploit code.

Other vulnerabilities in Apple Icloud

• CVE-2019-8506 Apple Multiple Products Type Confusion Exploited High 8.8
• CVE-2020-27932 Apple Multiple Products Type Confusion Exploited High 7.8
• CVE-2019-8746 Memory corruption in iOS Critical 9.8
• CVE-2019-8749 Memory corruption in iOS Critical 9.8
• CVE-2019-8756 Memory corruption in iOS Critical 9.8

All Apple Icloud vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-46698, GHSA-3mmq-4r29-8xqf, UBUNTU-CVE-2022-46698.