CVE-2023-23533

Exploited in the Wild

NIST CVSS Scores

CVSS v3.1 Base Score: 5.5 (Medium)

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA CVSS Scores

CVSS v3.1 Base Score: 5.5 (Medium)

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Operating Systems Impacted

macOS Monterey (prior to 12.6.4)
macOS Ventura (prior to 13.3)

Additional Resources

NVD CVE-2023-23533
macOS Monterey 12.6.4
macOS Ventura 13.3

Description

CVE-2023-23533 is a logic issue within macOS that could allow an application to modify protected parts of the file system. According to Kandji's analysis, this vulnerability allowed an attacker to swap the installer package after the system verified its code signature. The system would then install the supplied package instead of the original, enabling the attacker to bypass System Integrity Protection (SIP).

Impact

Exploitation of this vulnerability could lead to unauthorized modification of protected file system areas by an application. The severity of this issue has been assessed as follows: