Vulnerability-Lookup

CVE-2023-27945 (GCVE-0-2023-27945)

Vulnerability from cvelistv5 – Published: 2023-05-08 00:00 – Updated: 2025-01-29 15:16

Summary

This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-29 15:05 UTC

CWE

A sandboxed app may be able to collect system logs
CWE-125 - Out-of-bounds Read

Assigner

apple mitre root Scorecard

References

3 references

URL	Tags
https://support.apple.com/en-us/HT213759
https://support.apple.com/en-us/HT213679
https://support.apple.com/en-us/HT213760

Impacted products

3 products

Vendor	Product	Version	CPE status
Apple	macOS	Affected: unspecified , < 12.6 (custom)	guessed
Apple	Xcode	Affected: unspecified , < 14.3 (custom)	guessed
Apple	macOS	Affected: unspecified , < 11.7 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:23:30.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213759"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213679"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213760"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-27945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T15:05:48.755022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-29T15:16:00.740Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "12.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A sandboxed app may be able to collect system logs",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-27T03:47:25.542Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT213759"
        },
        {
          "url": "https://support.apple.com/en-us/HT213679"
        },
        {
          "url": "https://support.apple.com/en-us/HT213760"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2023-27945",
    "datePublished": "2023-05-08T00:00:00.000Z",
    "dateReserved": "2023-03-08T00:00:00.000Z",
    "dateUpdated": "2025-01-29T15:16:00.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-27945",
      "date": "2026-09-30",
      "epss": "0.00245",
      "percentile": "0.14154"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "37EC667B-49B0-4210-9B73-9795D603EF78",
                  "versionEndExcluding": "14.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs."
        }
      ],
      "id": "CVE-2023-27945",
      "lastModified": "2024-11-21T07:53:45.397",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 4.0,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-05-08T20:15:17.930",
      "references": [
        {
          "source": "product-security@apple.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/en-us/HT213679"
        },
        {
          "source": "product-security@apple.com",
          "url": "https://support.apple.com/en-us/HT213759"
        },
        {
          "source": "product-security@apple.com",
          "url": "https://support.apple.com/en-us/HT213760"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://support.apple.com/en-us/HT213679"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://support.apple.com/en-us/HT213759"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://support.apple.com/en-us/HT213760"
        }
      ],
      "sourceIdentifier": "product-security@apple.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "macOS",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "12.6",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Xcode",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "14.3",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "macOS",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "11.7",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "product-security@apple.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "37EC667B-49B0-4210-9B73-9795D603EF78",
                    "versionEndExcluding": "14.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs."
          }
        ],
        "id": "CVE-2023-27945",
        "lastModified": "2026-06-17T05:46:11.067",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 4.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 4.0,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-27945",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T15:05:48.755022Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-05-08T20:15:17.930",
        "references": [
          {
            "source": "product-security@apple.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/HT213679"
          },
          {
            "source": "product-security@apple.com",
            "url": "https://support.apple.com/en-us/HT213759"
          },
          {
            "source": "product-security@apple.com",
            "url": "https://support.apple.com/en-us/HT213760"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/HT213679"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://support.apple.com/en-us/HT213759"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://support.apple.com/en-us/HT213760"
          }
        ],
        "sourceIdentifier": "product-security@apple.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T00:03:05+00:00",
      "cve": "CVE-2023-27945",
      "id": "CVE-2023-27945",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2023-27945",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-27945.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T12:23:30.576Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/en-us/HT213759"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/en-us/HT213679"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://support.apple.com/en-us/HT213760"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "NONE",
                  "baseScore": 6.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "CHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-27945",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-01-29T15:05:48.755022Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-125",
                    "description": "CWE-125 Out-of-bounds Read",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-01-29T15:15:42.932Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "macOS",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "12.6",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Xcode",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "14.3",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "macOS",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "11.7",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "A sandboxed app may be able to collect system logs",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-07-27T03:47:25.542Z",
            "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
            "shortName": "apple"
          },
          "references": [
            {
              "url": "https://support.apple.com/en-us/HT213759"
            },
            {
              "url": "https://support.apple.com/en-us/HT213679"
            },
            {
              "url": "https://support.apple.com/en-us/HT213760"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "assignerShortName": "apple",
        "cveId": "CVE-2023-27945",
        "datePublished": "2023-05-08T00:00:00.000Z",
        "dateReserved": "2023-03-08T00:00:00.000Z",
        "dateUpdated": "2025-01-29T15:16:00.740Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2023-AVI-0390

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Apple. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données, une exécution de code arbitraire à distance, une atteinte à l'intégrité des données, un déni de service et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Apple	macOS	Apple macOS Big Sur versions antérieures à 11.7.7
Apple	Safari	Apple Safari versions antérieures à 16.5
Apple	N/A	Apple iOS versions antérieures à 16.5
Apple	N/A	Apple iPadOS versions antérieures à 16.5
Apple	N/A	Apple iPadOS versions antérieures à 15.7.6
Apple	N/A	Apple iOS versions antérieures à 15.7.6
Apple	macOS	Apple macOS Ventura versions antérieures à 13.4
Apple	macOS	Apple macOS Monterey versions antérieures à 12.6.6

References

Title

Publication Time

CERTFR-2023-AVI-0390

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Apple	macOS	Apple macOS Big Sur versions antérieures à 11.7.7
Apple	Safari	Apple Safari versions antérieures à 16.5
Apple	N/A	Apple iOS versions antérieures à 16.5
Apple	N/A	Apple iPadOS versions antérieures à 16.5
Apple	N/A	Apple iPadOS versions antérieures à 15.7.6
Apple	N/A	Apple iOS versions antérieures à 15.7.6
Apple	macOS	Apple macOS Ventura versions antérieures à 13.4
Apple	macOS	Apple macOS Monterey versions antérieures à 12.6.6

References

Title

Publication Time

FKIE_CVE-2023-27945

Vulnerability from fkie_nvd - Published: 2023-05-08 20:15 - Updated: 2026-06-17 05:46

Severity

6.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
6.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Summary

This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs.

References

URL	Tags
product-security@apple.com	https://support.apple.com/en-us/HT213679	Vendor Advisory
product-security@apple.com	https://support.apple.com/en-us/HT213759
product-security@apple.com	https://support.apple.com/en-us/HT213760
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/en-us/HT213679	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/en-us/HT213759
af854a3a-2127-422b-91ae-364da2661108	https://support.apple.com/en-us/HT213760

Impacted products

	Vendor	Product	Version
	apple	xcode	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "12.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "product-security@apple.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "37EC667B-49B0-4210-9B73-9795D603EF78",
              "versionEndExcluding": "14.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs."
    }
  ],
  "id": "CVE-2023-27945",
  "lastModified": "2026-06-17T05:46:11.067",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.0,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-27945",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-01-29T15:05:48.755022Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-05-08T20:15:17.930",
  "references": [
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/HT213679"
    },
    {
      "source": "product-security@apple.com",
      "url": "https://support.apple.com/en-us/HT213759"
    },
    {
      "source": "product-security@apple.com",
      "url": "https://support.apple.com/en-us/HT213760"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/HT213679"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.apple.com/en-us/HT213759"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.apple.com/en-us/HT213760"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-5H8H-FQ9X-XJW5

Vulnerability from github – Published: 2023-05-08 21:31 – Updated: 2024-04-04 03:51

Details

This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3. A sandboxed app may be able to collect system logs

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-27945"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-08T20:15:17Z",
    "severity": "MODERATE"
  },
  "details": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3. A sandboxed app may be able to collect system logs",
  "id": "GHSA-5h8h-fq9x-xjw5",
  "modified": "2024-04-04T03:51:55Z",
  "published": "2023-05-08T21:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27945"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213679"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213759"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213760"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT213759"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT213760"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2023/May/10"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2023/May/9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-27945

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs.

Aliases

CVE-2023-27945

Aliases

CVE-2023-27945

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-27945",
    "id": "GSD-2023-27945"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-27945"
      ],
      "details": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs.",
      "id": "GSD-2023-27945",
      "modified": "2023-12-13T01:20:55.970207Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "product-security@apple.com",
        "ID": "CVE-2023-27945",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "macOS",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "unspecified",
                          "version_value": "12.6"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Xcode",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "unspecified",
                          "version_value": "14.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Apple"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "A sandboxed app may be able to collect system logs"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://support.apple.com/en-us/HT213759",
            "refsource": "MISC",
            "url": "https://support.apple.com/en-us/HT213759"
          },
          {
            "name": "https://support.apple.com/en-us/HT213679",
            "refsource": "MISC",
            "url": "https://support.apple.com/en-us/HT213679"
          },
          {
            "name": "https://support.apple.com/en-us/HT213760",
            "refsource": "MISC",
            "url": "https://support.apple.com/en-us/HT213760"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "14.3",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2023-27945"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.apple.com/en-us/HT213679",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://support.apple.com/en-us/HT213679"
            },
            {
              "name": "https://support.apple.com/en-us/HT213760",
              "refsource": "MISC",
              "tags": [],
              "url": "https://support.apple.com/en-us/HT213760"
            },
            {
              "name": "https://support.apple.com/en-us/HT213759",
              "refsource": "MISC",
              "tags": [],
              "url": "https://support.apple.com/en-us/HT213759"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 4.0
        }
      },
      "lastModifiedDate": "2023-07-27T04:15Z",
      "publishedDate": "2023-05-08T20:15Z"
    }
  }
}

WID-SEC-W-2023-0811

Vulnerability from csaf_certbund - Published: 2023-03-30 22:00 - Updated: 2023-03-30 22:00

Summary

Apple Xcode: Mehrere Schwachstellen

Severity

Hoch

Scope

2 vulnerabilities in this advisory, including CVE-2023-27945.

CVE-2023-27945

Es existiert eine Schwachstelle in Apple Xcode. Der Fehler besteht aufgrund einer möglichen Sammlung von Systemprotokollen einer Sandbox-App in der Dev Tools-Komponente von Xcode. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.

Known affected: 1 product

Open the full advisory

WID-SEC-W-2023-1251

Vulnerability from csaf_certbund - Published: 2023-05-18 22:00 - Updated: 2024-08-19 22:00

Summary

Apple macOS: Mehrere Schwachstellen

Severity

Hoch

Scope

66 vulnerabilities in this advisory, including CVE-2023-27945.

CVE-2023-27945

In Apple macOS existieren mehrere Schwachstellen. Diese bestehen in den Komponenten "Accessibility", "AppleEvents", "AppleMobileFileIntegrity", "Associated Domains", "Contacts", "CoreLocation","CoreCapture", "Core Services", "CUPS", "dcerpc", "Dev Tools", "DesktopServices", "GeoServices", "ImageIO", "IOSurface", "IOSurfaceAccelerator", "Kernel, "LaunchServices", "libxpc", "Metal", "Model I/O", "NetworkExtension", "PackageKit", "PDFKit", "Perl", "Photos", "Sandbox", "Screen Saver","Shell", "Security", "Shortcuts", "Siri", "SQLite", "StorageKit", "System Settings", "Telephony", "TV App", "Weather", "WebKit" sowie "Wi-Fi". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um Administratorrechte zu erlangen, beliebigen Programmcode auszuführen, seine Privilegien zu erweitern, Informationen offenzulegen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-27945 (GCVE-0-2023-27945)

CERTFR-2023-AVI-0390

Solution

CERTFR-2023-AVI-0390

Solution

FKIE_CVE-2023-27945

GHSA-5H8H-FQ9X-XJW5

GSD-2023-27945

WID-SEC-W-2023-0811

WID-SEC-W-2023-1251

Tags

Sightings

Nomenclature

Related by attack behaviour