CVE-2022-32905 — Link Following in Apple Macos

CWE-59 — Link Following3 documents3 sources

Severity

7.8HIGHNVD

EPSS

0.1%

top 81.09%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apple Macos Apple Macos Ventura

Timeline

PublishedNov 1

Latest updateNov 2

Description

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMG file may lead to arbitrary code execution with system privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶Appleapple/macos_ventura13

▶CVEListV5apple/macosunspecified — 13

▶NVDapple/macos< 13.0

🔴Vulnerability Details

GHSA

GHSA-qj96-83mw-f2rw: This issue was addressed with improved validation of symlinks↗2022-11-02

▶

📋Vendor Advisories

Apple

CVE-2022-32905: macOS Ventura 13↗2022-10-24

▶