CVE-2023-37448

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A lock screen issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. A user may be able to view restricted content from the lock screen.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Apple	macOS	>= unspecified, < 14

References

http://seclists.org/fulldisclosure/2023/Oct/3Mailing List, Third Party Advisory
https://support.apple.com/en-us/HT213940Release Notes, Vendor Advisory
http://seclists.org/fulldisclosure/2023/Oct/3Mailing List, Third Party Advisory
https://support.apple.com/en-us/HT213940Release Notes, Vendor Advisory
https://support.apple.com/kb/HT213940

Timeline

Published: Sep 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-37455.5A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local at CVE-2023-374508.8The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5,CVE-2023-374534.6An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in d CVE-2023-374545.5An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf CVE-2023-374555.4The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability CVE-2023-374566.5The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS <CVE-2023-374578.2Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0 CVE-2023-374595.3Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG netwo CVE-2023-37465.4The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and ab CVE-2023-374609.8Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArch CVE-2023-374619.8Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../CVE-2023-374628.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `