An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files.
References
Link | Resource |
---|---|
https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057 | Third Party Advisory |
https://www.corecode.io/macupdater/history2.html | Release Notes |
https://www.corecode.io/macupdater/history3.html | Release Notes |
Configurations
Configuration 1 (hide)
|
History
26 Sep 2023, 15:00
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
CPE | cpe:2.3:a:corecode:macupdater:*:*:*:*:*:*:*:* | |
CWE | CWE-434 | |
First Time |
Corecode
Corecode macupdater |
|
References | (MISC) https://www.corecode.io/macupdater/history2.html - Release Notes | |
References | (MISC) https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057 - Third Party Advisory | |
References | (MISC) https://www.corecode.io/macupdater/history3.html - Release Notes |
20 Sep 2023, 14:25
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-09-20 14:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-41902
Mitre link : CVE-2023-41902
CVE.ORG link : CVE-2023-41902
JSON object : View
Products Affected
corecode
- macupdater
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type