Lucene search

[email protected]NVD:CVE-2023-28182

HistoryMay 08, 2023 - 8:15 p.m.

CVE-2023-28182

2023-05-0820:15:19

CWE-287

[email protected]

web.nvd.nist.gov

macos ventura 13.3

ios 16.4

ipados 16.4

ios 15.7.4

macos monterey 12.6.4

macos big sur 11.7.5

vpn server

eap

network position

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.1 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.1%

JSON

The issue was addressed with improved authentication. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A user in a privileged network position may be able to spoof a VPN server that is configured with EAP-only authentication on a device.

Affected configurations

NVD

Node

appleipad_osRange<15.7.4

appleipad_osRange16.0–16.4

appleiphone_osRange<15.7.4

appleiphone_osRange16.0–16.4

applemacosRange11.0–11.7.5

applemacosRange12.0–12.6.4

applemacosRange13.0–13.3

References

support.apple.com/en-us/HT213670

support.apple.com/en-us/HT213673

support.apple.com/en-us/HT213675

support.apple.com/en-us/HT213676

support.apple.com/en-us/HT213677

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

5.1 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.1%

JSON

Related for NVD:CVE-2023-28182

cvelist1 prion1 cve1 nessus3 apple5 openvas3