PT-2024-29794 · Agilebits · 1Password

Published 2024-08-06 · Updated 2024-09-16 · CVE-2024-42219

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1Password versions prior to 8.10.36 for macOS

Description The issue allows local attackers to exfiltrate vault items due to insufficient XPC inter-process communication validation.

Recommendations For versions prior to 8.10.36, update to version 8.10.36 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-1289

Related Identifiers

CVE-2024-42219

Affected Products

1Password

References · 15

• https://support.1password.com/kb/202408a · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42219 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42219 · Vendor Advisory
• https://twitter.com/iEtoSharu/status/1823114196021858351 · Twitter Post
• https://twitter.com/markcartertm/status/1822993671014523223 · Twitter Post
• https://twitter.com/Komodosec/status/1835741842488668496 · Twitter Post
• https://t.me/pentestingnews/50161 · Telegram Post
• https://twitter.com/XArthurDent/status/1823122836770402431 · Twitter Post
• https://t.me/cvedetector/2644 · Telegram Post
• https://app-updates.agilebits.com · Note
• https://twitter.com/imabit_inc/status/1829621927746351302 · Twitter Post
• https://twitter.com/Action1corp/status/1823421463434571948 · Twitter Post
• https://t.me/true_secator/6078 · Telegram Post
• https://twitter.com/pandaly520/status/1823307945737920524 · Twitter Post
• https://twitter.com/CCBalert/status/1823001338311065902 · Twitter Post