Auth bypass in Apple macOS
CVE-2024-7062
Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insufficient validation of a client’s authorization before executing an operation. Consequently, it is possible to execute system-level commands as the root user, such as changing permissions and ownership, obtaining a handle (file descriptor) of an arbitrary file, and terminating processes, among other operations.
Vulnerability class: Broken Access Control
EPSS: 0.002 (16.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- 41c37e40-543d-43a2-b660-2fee83ea851a (Exploit, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2024-7062?
- CVE-2024-7062 is a high-severity vulnerability in Apple macOS, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2024-07-26.
- How severe is CVE-2024-7062?
- High severity. CVSS v3 base score is 8.8 out of 10.