CVEvulnerability
CVE-2022-26704
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-05-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-59
Description
A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
Affected configurations
• apple mac os x (>= 10.15 < 10.15.7)
• apple mac os x 10.15.7
• apple macos (>= 11.0 < 11.6.8)
• apple macos (>= 12.0.0 < 12.4)
Related
Weakness · CWE (1)
- CWE-59 Improper Link Resolution Before File Access weakness
References
- http://seclists.org/fulldisclosure/2022/Jul/13 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Jul/14 Mailing List, Third Party Advisory
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0032/MNDT-2022-0032.md Technical Description, Third Party Advisory
- https://support.apple.com/en-us/HT213257 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT213343 Mailing List
- https://support.apple.com/kb/HT213344 Vendor Advisory
- http://seclists.org/fulldisclosure/2022/Jul/13 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Jul/14 Mailing List, Third Party Advisory
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0032/MNDT-2022-0032.md Technical Description, Third Party Advisory
- https://support.apple.com/en-us/HT213257 Release Notes, Vendor Advisory
- https://support.apple.com/kb/HT213343 Mailing List
- https://support.apple.com/kb/HT213344 Vendor Advisory