CVE-2023-23543

LowCVSS 3.6/10Last modified Jun 17, 2026

Description

The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. A sandboxed app may be able to determine which app is currently using the camera.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Apple	macOS	>= unspecified, < 13.3
Apple	iOS and iPadOS	>= unspecified, < 16.4
Apple	watchOS	>= unspecified, < 9.4
Apple	iOS and iPadOS	>= unspecified, < 15.7

References

https://support.apple.com/en-us/HT213670Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213673Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213676Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213678
https://support.apple.com/en-us/HT213670Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213673Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213676Release Notes, Vendor Advisory
https://support.apple.com/en-us/HT213678

Timeline

Published: May 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-235455.3Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote un CVE-2023-235468.1A misconfiguration vulnerability exists in the urvpn_client functionality of Milesight UR32L v32.3.0.5. A specially-crafted man-in-the-middl CVE-2023-235476.5A directory traversal vulnerability exists in the luci2-io file-export mib functionality of Milesight UR32L v32.3.0.5. A specially crafted n CVE-2023-235486.1Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.CVE-2023-235492.7Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the CVE-2023-23557.8Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before b CVE-2023-235507.2An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafte CVE-2023-235519.8Control By Web X-600M devices run Lua scripts and are vulnerable to code injection, which could allow an attacker to remotely execute arbitr CVE-2023-235527.5On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a CVE-2023-235536.1Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session information being tr CVE-2023-235548.8Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions CVE-2023-235557.5On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP