PT-2023-4078 · Apple · Apple Macos

Mickey Jin + 1 · Published 2023-07-24 · Updated 2023-08-02 · CVE-2023-36862

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 13.5

Description A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue may allow an app to determine a user’s current location. The vulnerability is related to errors in security settings, which can be exploited to bypass security restrictions and gain unauthorized access to protected information.

Recommendations For versions prior to 13.5, update to macOS Ventura 13.5 to resolve the issue. As a temporary workaround, consider restricting access to sensitive location data until the update is applied.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2023-04378

CVE-2023-36862

Affected Products

Apple Macos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-36862 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36862 · Vendor Advisory
• https://support.apple.com/en-us/HT213843 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04378 · Security Note
• https://t.me/cvenotify/55297 · Telegram Post