CVE-2024-22405 MEDIUM

CVE-2024-22405: XADMaster may not apply quarantine attribute correctly to extracted files

Vendor Macpaw
Product XADMaster
Weakness CWE-281
Published April 30, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

April 30, 2024 CVE published
August 1, 2024 Record updated