Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-47m3-cr54-pvmq

Опубликовано: 28 фев. 2025
Источник: github
Github: Не прошло ревью
CVSS4: 9.2

Описание

DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3.

DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3.

EPSS

Процентиль: 6%
0.00023
Низкий

9.2 Critical

CVSS4

Дефекты

CWE-266
CWE-732

Связанные уязвимости

nvd
12 месяцев назад

DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3.

EPSS

Процентиль: 6%
0.00023
Низкий

9.2 Critical

CVSS4

Дефекты

CWE-266
CWE-732