{"id":"CVE-2023-42838","state":"PUBLISHED","title":"An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app may be able to execute","description":"An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.","publishedAt":"2024-02-21T06:41:24.366Z","updatedAt":"2025-11-04T19:22:16.497Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apple","products":["Apple macOS"],"affected":[{"vendor":"Apple","product":"macOS","versions":[{"version":"unspecified","status":"affected","lessThan":"13.6","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"unspecified","status":"affected","lessThan":"14.1","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"unspecified","status":"affected","lessThan":"12.7","versionType":"custom"}]}],"references":["https://support.apple.com/en-us/HT214038","https://support.apple.com/en-us/HT213984","https://support.apple.com/en-us/HT214037","https://support.apple.com/kb/HT214038","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT213984"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:06:17.512Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/42xxx/CVE-2023-42838.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-42838","state":"PUBLISHED","datePublished":"2024-02-21T06:41:24.366Z","dateUpdated":"2025-11-04T19:22:16.497Z","assignerShortName":"apple","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateReserved":"2023-09-14T19:05:11.449Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges."}],"affected":[{"vendor":"Apple","product":"macOS","versions":[{"version":"unspecified","status":"affected","lessThan":"13.6","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"unspecified","status":"affected","lessThan":"14.1","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"unspecified","status":"affected","lessThan":"12.7","versionType":"custom"}]}],"references":[{"url":"https://support.apple.com/en-us/HT214038"},{"url":"https://support.apple.com/en-us/HT213984"},{"url":"https://support.apple.com/en-us/HT214037"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges"}]}],"providerMetadata":{"shortName":"apple","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateUpdated":"2024-02-21T06:41:24.366Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://support.apple.com/en-us/HT214038","tags":["x_transferred"]},{"url":"https://support.apple.com/en-us/HT213984","tags":["x_transferred"]},{"url":"https://support.apple.com/en-us/HT214037","tags":["x_transferred"]},{"url":"https://support.apple.com/kb/HT214038"},{"url":"https://support.apple.com/kb/HT214037"},{"url":"https://support.apple.com/kb/HT213984"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T19:22:16.497Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"apple","product":"macos","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"12.7.2","versionType":"custom"},{"version":"13.0","status":"affected","lessThan":"13.6.3","versionType":"custom"},{"version":"14.0","status":"affected","lessThan":"14.1","versionType":"custom"}],"cpes":["cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:macos:13.0:*:*:*:*:*:*:*","cpe:2.3:o:apple:macos:14.0:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.2,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-02-21T20:12:16.790030Z","id":"CVE-2023-42838","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-09T15:43:10.335Z"}}]}}}