CVE-2022-26704

A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
appleCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
VendorProductVersion
applemac_os_x
10.15 ≤
𝑥
< 10.15.7
applemac_os_x
10.15.7
applemac_os_x
10.15.7:security_update_2020
applemac_os_x
10.15.7:security_update_2020-001
applemac_os_x
10.15.7:security_update_2020-005
applemac_os_x
10.15.7:security_update_2020-007
applemac_os_x
10.15.7:security_update_2021-001
applemac_os_x
10.15.7:security_update_2021-002
applemac_os_x
10.15.7:security_update_2021-003
applemac_os_x
10.15.7:security_update_2021-004
applemac_os_x
10.15.7:security_update_2021-005
applemac_os_x
10.15.7:security_update_2021-006
applemac_os_x
10.15.7:security_update_2021-007
applemac_os_x
10.15.7:security_update_2021-008
applemac_os_x
10.15.7:security_update_2022-001
applemac_os_x
10.15.7:security_update_2022-002
applemac_os_x
10.15.7:security_update_2022-003
applemac_os_x
10.15.7:security_update_2022-004
applemacos
11.0 ≤
𝑥
< 11.6.8
applemacos
12.0.0 ≤
𝑥
< 12.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2022/Jul/13
http://seclists.org/fulldisclosure/2022/Jul/14
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0032/MNDT-2022-0032.md
https://support.apple.com/en-us/HT213257
https://support.apple.com/kb/HT213343
https://support.apple.com/kb/HT213344
http://seclists.org/fulldisclosure/2022/Jul/13
http://seclists.org/fulldisclosure/2022/Jul/14
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0032/MNDT-2022-0032.md
https://support.apple.com/en-us/HT213257
https://support.apple.com/kb/HT213343
https://support.apple.com/kb/HT213344