CVE-2024-23245

low

Description

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent.

References

https://support.apple.com/en-us/HT214085

https://support.apple.com/en-us/HT214084

https://support.apple.com/en-us/HT214083

http://seclists.org/fulldisclosure/2024/Mar/23

http://seclists.org/fulldisclosure/2024/Mar/22

http://seclists.org/fulldisclosure/2024/Mar/21

Details

Source: Mitre, NVD

Published: 2024-03-08

Updated: 2024-12-06

Risk Information

CVSS v2

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N

Severity: Low

CVSS v3

Base Score: 3.3

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Severity: Low