PT-2024-19739 · Apple · Macos Monterey+4

Published 2024-03-07 · Updated 2024-12-06 · CVE-2024-23245

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions macOS Sonoma versions prior to 14.4 macOS Monterey versions prior to 12.7.4 macOS Ventura versions prior to 13.6.5

Description This issue was addressed by adding an additional prompt for user consent. Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent.

Recommendations For macOS Sonoma versions prior to 14.4, update to macOS Sonoma 14.4 to resolve the issue. For macOS Monterey versions prior to 12.7.4, update to macOS Monterey 12.7.4 to resolve the issue. For macOS Ventura versions prior to 13.6.5, update to macOS Ventura 13.6.5 to resolve the issue. As a temporary workaround, consider restricting the use of third-party shortcuts that utilize legacy actions from Automator until the issue is resolved.

Fix

Related Identifiers

CVE-2024-23245

Affected Products

Automator

Apple Macos

Macos Monterey

Macos Sonoma

Macos Ventura

References · 19

• https://support.apple.com/en-us/HT214085 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/705643 · Security Note
• https://support.apple.com/en-us/HT214084 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23245 · Security Note
• https://support.apple.com/en-us/HT214083 · Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Mar/23 · Note
• https://support.apple.com/kb/HT214085 · Note
• https://t.me/cvenotify/103249 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Mar/21 · Note
• https://support.apple.com/kb/HT214083 · Note
• http://seclists.org/fulldisclosure/2024/Mar/22 · Note
• https://support.apple.com/en-us/120886 · Note
• https://support.apple.com/en-us/120884 · Note
• https://twitter.com/CVEnew/status/1765925950720475436 · Twitter Post