7.8high
CVE-2018-4237in critical feed2 exploits
An issue was discovered in certain Apple products.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
13.5%
percentile 96%
Public exploits
2
Metasploit · Exploit-DB
Summary
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "libxpc" component. It allows attackers to gain privileges via a crafted app that leverages a logic error.
Exploit prediction (EPSS)
13.48% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
Exploits and detections
- Metasploit exploit/osx/local/libxpc_mitm_ssudo Mac OS X libxpc MITM Privilege Escalation · metasploit exploit, excellent rank · 2018-03-15
- EDB-45916 Mac OS X - libxpc MITM Privilege Escalation (Metasploit) · local · 2018-11-29
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
References
- support.apple.com /HT208850 · x_refsource_CONFIRM, x_transferred
- support.apple.com /HT208851 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1041027 · vdb-entry, x_refsource_SECTRACK, x_transferred
- support.apple.com /HT208848 · x_refsource_CONFIRM, x_transferred
- support.apple.com /HT208849 · x_refsource_CONFIRM, x_transferred
- exploit-db.com /exploits/45916/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
Sources
- CVE List: CVE-2018-4237
- NVD: CVE-2018-4237
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.