PT-2023-8680 · Apple · Apple Macos

Asentientbot · Published 2023-10-25 · Updated 2024-01-29 · CVE-2023-42935

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 13.6.4

Description The issue is related to an authentication problem in the macOS operating system, specifically with the LoginWindow component. It is caused by inadequate authentication procedures, which can be exploited by a local attacker to view the previous logged-in user's desktop from the fast user switching screen.

Recommendations For versions prior to 13.6.4, update to macOS Ventura 13.6.4 to resolve the issue. As a temporary workaround, consider restricting access to the fast user switching screen until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-01502

CVE-2023-42935

Affected Products

Apple Macos

References · 11

• https://bdu.fstec.ru/vul/2024-01502 · Security Note
• https://support.apple.com/en-us/HT214058 · Vendor Advisory
• https://support.apple.com/kb/HT213984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42935 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42935 · Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Jan/37 · Note
• https://support.apple.com/kb/HT214058 · Note
• https://twitter.com/CVEnew/status/1749599894627570057 · Twitter Post
• https://vuldb.com/?id.251781 · Note
• https://t.me/cvenotify/69125 · Telegram Post
• https://t.me/cvenotify/68281 · Telegram Post