Lucene search

[email protected]CVE-2023-41138

HistoryNov 09, 2023 - 3:15 p.m.

CVE-2023-41138

2023-11-0915:15:08

CWE-226

[email protected]

web.nvd.nist.gov

cve-2023-41138

appsanywhere

macos

privileged helper

elevated permissions

nvd

7.5 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process.

Affected configurations

NVD

Node

appsanywhereappsanywhere_clientMatch1.4.0macos

appsanywhereappsanywhere_clientMatch1.4.1macos

appsanywhereappsanywhere_clientMatch1.5.1macos

appsanywhereappsanywhere_clientMatch1.5.2macos

appsanywhereappsanywhere_clientMatch1.6.0macos

appsanywhereappsanywhere_clientMatch2.0.0macos

CPENameOperatorVersion
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.4.0
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.4.1
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.5.1
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.5.2
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.6.0
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq2.0.0

CPE	Name	Operator	Version
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.4.0
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.4.1
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.5.1
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.5.2
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.6.0
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	2.0.0

CNA Affected

[
  {
    "vendor": "AppsAnywhere",
    "product": "AppsAnywhere Client",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "1.4.0",
        "status": "affected"
      },
      {
        "version": "1.4.1",
        "status": "affected"
      },
      {
        "version": "1.5.1",
        "status": "affected"
      },
      {
        "version": "1.5.2",
        "status": "affected"
      },
      {
        "version": "1.6.0",
        "status": "affected"
      },
      {
        "version": "2.0.0",
        "status": "affected"
      },
      {
        "version": "1.6.1",
        "status": "unaffected"
      },
      {
        "version": "2.0.1",
        "status": "unaffected"
      },
      {
        "version": "2.2.0",
        "status": "unaffected"
      }
    ]
  }
]

References

docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory

7.5 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-41138

nvd1 prion1 cvelist1