vulnwire
7.2high

CVE-2008-28301 exploit

Open Scripting Architecture in Apple Mac OS X 10.4.11 and 10.5.4, and some other 10.4 and 10.5 versions, does not properly restrict the loa…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 59%
Public exploits
1
Exploit-DB

Open Scripting Architecture in Apple Mac OS X 10.4.11 and 10.5.4, and some other 10.4 and 10.5 versions, does not properly restrict the loading of scripting addition plugins, which allows local users to gain privileges via scripting addition commands to a privileged application, as originally demonstrated by an osascript tell command to ARDAgent.

Exploit prediction (EPSS)

0.87% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.

Exploits and detections

  • EDB-31940 Apple Mac OSX 10.x - Applescript ARDAgent Shell Privilege Escalation · local · 2008-06-19

CVSS scores

Assigned byVersionScoreVector
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • vupen.com /english/advisories/2008/1905/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • lists.apple.com /archives/security-announce//2008/Jul/msg00003.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • secunia.com /advisories/30776 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/43294 · vdb-entry, x_refsource_XF, x_transferred
  • it.slashdot.org /it/08/06/18/1919224.shtml · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/29831 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id?1020345 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.apple.com /archives/security-announce//2008//Sep/msg00006.html · vendor-advisory, x_refsource_APPLE, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.