CVE-2024-27301
CVSS 3.1 Score 7.3 of 10 (high)
Details
Summary
CVE-2024-27301 is a vulnerability affecting the Support App, an opensource tool for managing Apple devices. The issue lies in the use of the `#!/bin/zsh` shebang in the installer script, which results in the execution of the `$HOME/.zshenv` file when installed as root. Malicious code added to this file can be executed, potentially allowing an attacker to escalate privileges on the system. The vulnerability has been addressed in version 2.5.1 Rev 2, and all users are advised to upgrade as soon as possible. There are currently no known workarounds for this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.