CVEvulnerability
CVE-2018-6823
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-02-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service that can be abused to execute scripts as root.
Affected configurations
• mailbutler shimo (< 4.1.5.1)
References
- https://github.com/VerSprite/research/blob/master/advisories/VS-2018-001.md Third Party Advisory
- https://github.com/VerSprite/research/blob/master/advisories/VS-2018-001.md Third Party Advisory