CVE-2017-7150
MEDIUMmacOS < 10.12.6 - Unauthenticated Password Extraction via Synthetic Click
Title source: llmDescription
An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "Security" component. It allows attackers to bypass the keychain access prompt, and consequently extract passwords, via a synthetic click.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT208165
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1039430
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/101177
Scores
CVSS v3
5.5
EPSS
0.0033
EPSS Percentile
24.4%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-521
Status
published
Products (1)
apple/mac_os_x
< 10.12.6
Published
Oct 23, 2017
Tracked Since
Feb 18, 2026