CVE-2023-41902

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057Third Party Advisory
https://www.corecode.io/macupdater/history2.htmlRelease Notes
https://www.corecode.io/macupdater/history3.htmlRelease Notes
https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057Third Party Advisory
https://www.corecode.io/macupdater/history2.htmlRelease Notes
https://www.corecode.io/macupdater/history3.htmlRelease Notes

Timeline

Published: Sep 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-419045.4Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.CVE-2023-419055.4NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.CVE-2023-419085.3Cerebrate before 1.15 lacks the Secure attribute for the session cookie.CVE-2023-419097.5An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no at CVE-2023-41919.8A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. Affected by this issue is CVE-2023-419109.8An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can rem CVE-2023-419115.5Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).CVE-2023-419139.8strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the int CVE-2023-419147.0SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwrit CVE-2023-419158.1OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execut CVE-2023-419166.5In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in th CVE-2023-4191710.0Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by a