CVE-2024-23267 - OpenCVE

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to bypass certain Privacy preferences.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Macos

Configuration 1 [-]

OR	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2024/Mar/21
http://seclists.org/fulldisclosure/2024/Mar/22
http://seclists.org/fulldisclosure/2024/Mar/23
https://support.apple.com/en-us/HT214083
https://support.apple.com/en-us/HT214084
https://support.apple.com/en-us/HT214085

History

No history.

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2024-03-08T01:35:40.987Z

Updated: 2024-08-28T15:44:54.628Z

Reserved: 2024-01-12T22:22:21.491Z

Link: CVE-2024-23267

Vulnrichment

Updated: 2024-08-01T22:59:32.087Z

NVD

Status : Analyzed

Published: 2024-03-08T02:15:49.177

Modified: 2024-03-14T19:05:20.860

Link: CVE-2024-23267

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23267", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2024-01-12T22:22:21.491Z", "datePublished": "2024-03-08T01:35:40.987Z", "dateUpdated": "2024-08-28T15:44:54.628Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An app may be able to bypass certain Privacy preferences"}]}], "affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "12.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "13.6", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "14.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to bypass certain Privacy preferences."}], "references": [{"url": "https://support.apple.com/en-us/HT214083"}, {"url": "https://support.apple.com/en-us/HT214085"}, {"url": "https://support.apple.com/en-us/HT214084"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/21"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/22"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/23"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2024-03-08T01:35:40.987Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:59:32.087Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.apple.com/en-us/HT214083", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214085", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214084", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/21", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/22", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/23", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-28T15:44:46.855450Z", "id": "CVE-2024-23267", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T15:44:54.628Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.apple.com/en-us/HT214083", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214085", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214084", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/21", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/22", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/23", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:59:32.087Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23267", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-28T15:44:46.855450Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T15:44:51.318Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "12.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "13.6", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "14.4", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/HT214083"}, {"url": "https://support.apple.com/en-us/HT214085"}, {"url": "https://support.apple.com/en-us/HT214084"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/21"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/22"}, {"url": "http://seclists.org/fulldisclosure/2024/Mar/23"}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to bypass certain Privacy preferences."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An app may be able to bypass certain Privacy preferences"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2024-03-08T01:35:40.987Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23267", "state": "PUBLISHED", "dateUpdated": "2024-08-28T15:44:54.628Z", "dateReserved": "2024-01-12T22:22:21.491Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2024-03-08T01:35:40.987Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "079C046D-9CEF-4B49-B1BB-D0376801198D", "versionEndExcluding": "12.7.4", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "69C4F06A-061F-46B3-8BB7-5C9B47C00956", "versionEndExcluding": "13.6.5", "versionStartIncluding": "13.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "73160D1F-755B-46D2-969F-DF8E43BB1099", "versionEndExcluding": "14.4", "versionStartIncluding": "14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to bypass certain Privacy preferences."}, {"lang": "es", "value": "El problema se solucion\u00f3 con controles mejorados. Este problema se solucion\u00f3 en macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. Es posible que una aplicaci\u00f3n pueda omitir ciertas preferencias de privacidad."}], "id": "CVE-2024-23267", "lastModified": "2024-03-14T19:05:20.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-03-08T02:15:49.177", "references": [{"source": "product-security@apple.com", "tags": ["Mailing List"], "url": "http://seclists.org/fulldisclosure/2024/Mar/21"}, {"source": "product-security@apple.com", "tags": ["Mailing List"], "url": "http://seclists.org/fulldisclosure/2024/Mar/22"}, {"source": "product-security@apple.com", "tags": ["Mailing List"], "url": "http://seclists.org/fulldisclosure/2024/Mar/23"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214083"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214084"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214085"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}