CVE-2023-32422

5.5MEDIUM

Key Information

Vendor
Apple
Status
Mac OS
iOS And iPad OS
TV OS
Vendor
CVE Published:
23 June 2023

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

Summary

This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5 and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to bypass Privacy preferences.

Affected Version(s)

macOS < 13.4

iOS and iPadOS < 16.5

tvOS < 16.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-32422-a-macOS-TCC-bypass-in-sqlite
Created by gergelykalman

News Articles

favicon imagegergelykalman.com

Gergely's hack blog

Gergely's blog about hacking, privacy, and everything else

1 month ago

References

https://support.apple.com/en-us/HT213758
https://support.apple.com/en-us/HT213757
https://support.apple.com/en-us/HT213761

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by gergelykalman.com

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database1 Proof of Concept(s)1 News Article(s)
.