CVE-2019-5011 Privilege escalation in CleanMyMac X

What is CVE-2019-5011?

CVE-2019-5011 is a high-severity vulnerability in CleanMyMac X, published on 21 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating. The application failed to remove the vulnerable components upon upgrading to the latest version, leaving the user open to attack. A user with local access can use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful exploit.

Weakness: CWE-459

Which versions are affected by CVE-2019-5011?

It affects 1 product.

Products include Macpaw Cleanmymac X.

How do I fix CVE-2019-5011?

No fix has been published for CVE-2019-5011 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-5011 being exploited?

There is no known exploitation of CVE-2019-5011 in the wild and no public exploit code.

Other vulnerabilities in CleanMyMac X

• CVE-2018-4032 Privilege escalation in Clean My Mac High 7.1
• CVE-2018-4033 Privilege escalation in Clean My Mac High 7.1
• CVE-2018-4034 Privilege escalation in Clean My Mac High 7.1
• CVE-2018-4035 Privilege escalation in Clean My Mac High 7.1
• CVE-2018-4036 Privilege escalation in Clean My Mac High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8xx8-72q4-m3hg.