The issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.6.1. An attacker may be able to access passkeys without authentication.
References
| Link | Resource |
|---|---|
| http://seclists.org/fulldisclosure/2023/Oct/26 | Mailing List Third Party Advisory |
| https://support.apple.com/en-us/HT213985 | Release Notes Vendor Advisory |
| https://support.apple.com/kb/HT213927 | |
| https://support.apple.com/kb/HT213938 | |
| https://support.apple.com/kb/HT213940 | |
| https://support.apple.com/kb/HT213985 | Release Notes Vendor Advisory |
Configurations
History
22 Dec 2023, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Nov 2023, 19:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | |
| CWE | CWE-306 | |
| References | (MISC) http://seclists.org/fulldisclosure/2023/Oct/26 - Mailing List, Third Party Advisory | |
| References | (MISC) https://support.apple.com/en-us/HT213985 - Release Notes, Vendor Advisory | |
| References | (MISC) https://support.apple.com/kb/HT213985 - Release Notes, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Apple macos
Apple |
26 Oct 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Oct 2023, 20:31
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Oct 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-25 19:15
Updated : 2023-12-22 23:15
NVD link : CVE-2023-40401
Mitre link : CVE-2023-40401
CVE.ORG link : CVE-2023-40401
JSON object : View
Products Affected
apple
- macos
CWE
CWE-306
Missing Authentication for Critical Function