CVE-2023-32370 Security feature bypass in macOS
Attackers can bypass Content Security Policy restrictions on macOS due to a validation logic error in wildcard domain handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32370?
CVE-2023-32370 is a medium-severity vulnerability in Apple Macos, published on 6 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Policy to block domains with wildcards may fail.
Which versions are affected by CVE-2023-32370?
It affects 3 products.
Products include Apple Macos, Webkitgtk Webkitgtk, Wpewebkit Wpe Webkit.
How do I fix CVE-2023-32370?
Apply the vendor's patch.
Is CVE-2023-32370 being exploited?
There is no known exploitation of CVE-2023-32370 in the wild and no public exploit code.
Other vulnerabilities in Apple Macos
Sources
Also known as DEBIAN-CVE-2023-32370, GHSA-m6rg-hrc7-fqpj, UBUNTU-CVE-2023-32370.