CVE-2020-9771
published 2020-10-22CVE-2020-9771: This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system.
PriorityP180high7.1CVSS 3.1
AVLACLPRLUINSUCHIHAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.37%
30.2th percentile
This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | < 10.15.4 | 10.15.4 |
| apple | macos | >= unspecified < macOS Catalina 10.15.4 | macOS Catalina 10.15.4 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.03.6LOWAV:L/AC:L/Au:N/C:P/I:P/A:N
vulncheck7.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x973-w3pf-v4m8: This issue was addressed with a new entitlement
ghsa_unreviewed·2022-05-24
CVE-2020-9771 [HIGH] GHSA-x973-w3pf-v4m8: This issue was addressed with a new entitlement
This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system.
VulnCheck
macOS APFS Snapshot Mount Authorization Bypass
vulncheck·2020·CVSS 7.1
CVE-2020-9771 [HIGH] macOS APFS Snapshot Mount Authorization Bypass
macOS APFS Snapshot Mount Authorization Bypass
This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system.
Affected: Apple MacOS X
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.jamf.com/blog/amnesia-stealer-macos-infostealer-clickfix/
No detection rules found.
No public exploits indexed.
Hackernews
AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
blogs_hackernews·2026-08-13
CVE-2020-9771 AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that's capable of hijacking Chromium web browsers to steal session data.
The multi-stage stealer is spread via a counterfeit GitHub download page titled "Download for macOS" and claims to be from a verified publisher. The page employs a ClickFix-style lure that instructs users to copy and paste a Base64-encoded command into the macOS Terminal app.
The attack chain ultimately leads to the deployment of AmnesiaSte
Bleepingcomputer
Microsoft: macOS Sploitlight flaw leaks Apple Intelligence data
blogs_bleepingcomputer·2025-07-28·CVSS 7.1
CVE-2020-9771 [HIGH] Microsoft: macOS Sploitlight flaw leaks Apple Intelligence data
## Microsoft: macOS Sploitlight flaw leaks Apple Intelligence data
## Sergiu Gatlan
Since 2020, Apple has patched other TCC bypasses that exploit Time Machine mounts ( CVE-2020-9771 ), environment variable poisoning ( CVE-2020-9934 ), and a bundle conclusion issue ( CVE-2021-30713 ) . In the past, Microsoft security researchers have also discovered several other TCC bypasses, including powerdir ( CVE-2021-30970 ) and HM-Surf , that could also be abused to gain access to users' private data.
"While similar to prior TCC bypasses like HM-Surf and powerdir, the implications of this vulnerability, which we refer to as 'Sploitlight' for its use of Spotlight plugins, are more severe due to its ability to extract and leak sensitive information cached by Apple Intelligence, such as precise geol
Sentinelone
Bypassing macOS TCC User Privacy Protections By Accident and Design
blogs_sentinelone·2021-07-01
Bypassing macOS TCC User Privacy Protections By Accident and Design
## Bypassing macOS TCC User Privacy Protections By Accident and Design
## Executive Summary
TCC is meant to protect user data from unauthorized access, but weaknesses in its design mean that protections are easily overridden inadvertently.
Automation, by design, allows Full Disk Access to be ‘backdoored’ while also lowering the authorization barrier.
Multiple partial and full TCC bypasses are known, with several actively exploited in the wild.
TCC does not prevent processes reading and writing to ‘protected’ locations, a loophole that can be used to hide malware.
## Introduction
In recent years, protecting sensitive user data on-device has become of increasing importance, particularly now that our phones, tablets and computers are used for creating, storing and transmitting the most
Sentinelone
Bypassing macOS TCC User Privacy Protections By Accident and Design - SentinelLabs
blogs_sentinelone·2021-07-01
Bypassing macOS TCC User Privacy Protections By Accident and Design - SentinelLabs
## Executive Summary
- TCC is meant to protect user data from unauthorized access, but weaknesses in its design mean that protections are easily overridden inadvertently.
- Automation, by design, allows Full Disk Access to be ‘backdoored’ while also lowering the authorization barrier.
- Multiple partial and full TCC bypasses are known, with several actively exploited in the wild.
- TCC does not prevent processes reading and writing to ‘protected’ locations, a loophole that can be used to hide malware.
## Introduction
In recent years, protecting sensitive user data on-device has become of increasing importance, particularly now that our phones, tablets and computers are used for creating, storing and transmitting the most sensitive data about us: from selfies and family videos to passwor
2020-10-22
Published
Exploited in the wild