CVE-2022-26704

CWE-597 documents4 sources
Severity
7.8HIGH
EPSS
0.4%
top 41.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple MacosApple MAC OS X
Timeline
PublishedMay 26
Latest updateJul 20

Description

A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5apple/macosunspecified — 12.4
▶NVDapple/macos11.0 — 11.6.8+1
▶NVDapple/mac_os_x10.15 — 10.15.7+1

🔴Vulnerability Details

2
GHSA
GHSA-3f8h-c4rw-wc8f: A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks↗2022-05-27
▶
CVEList
CVE-2022-26704: A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks↗2022-05-26
▶

📋Vendor Advisories

4
Apple
CVE-2022-26704: macOS Big Sur 11.6.8↗2022-07-20
▶
Apple
CVE-2022-26704: Security Update 2022-005 Catalina↗2022-07-20
▶
Apple
CVE-2022-26704: macOS Monterey 12.4↗2022-05-16
▶
Apple
CVE-2022-26704: iOS 15.5 and iPadOS 15.5↗2022-05-16
▶
CVE-2022-26704 (HIGH CVSS 7.8) | A validation issue existed in the h | cvebase.io