PT-2023-28157 · Corecode · Macupdater

Erhad Husovic · Publicado 2023-09-20 · Atualizado 2023-09-26 · CVE-2023-41902

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CoreCode MacUpdater versions prior to 2.3.8 CoreCode MacUpdater versions 3.x prior to 3.1.2

Description An XPC misconfiguration issue allows attackers to escalate privileges by crafting malicious .pkg files.

Recommendations For versions prior to 2.3.8, update to version 2.3.8 or later. For versions 3.x prior to 3.1.2, update to version 3.1.2 or later.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-41902

Produtos afetados

Macupdater

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-41902 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1704547462755586423 · Publicação no Twitter
• https://corecode.io/macupdater/history2.html · Nota
• https://corecode.io/macupdater/history3.html · Nota
• https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057 · Nota
• https://twitter.com/CVEnew/status/1704493974512120143 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-41902 · Aviso do Fabricante