ByteOS Network

CVE Vulnerability Details :

CVE-2022-42855

PUBLISHED

More Info Official Page

Assigner-apple

Assigner Org ID-286789f9-fbc2-4510-9f9a-43facdede74c

Published At-15 Dec, 2022 | 00:00

Updated At-21 Apr, 2025 | 16:06

▼CVE Numbering Authority (CNA)

A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to use arbitrary entitlements.

From unspecified before 15.7 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	An app may be able to use arbitrary entitlements

Type: text

CWE ID: N/A

Description: An app may be able to use arbitrary entitlements

References

Hyperlink	Resource
https://support.apple.com/kb/HT213536	N/A
https://support.apple.com/en-us/HT213535	N/A
https://support.apple.com/en-us/HT213532	N/A
https://support.apple.com/en-us/HT213530	N/A
https://support.apple.com/en-us/HT213531	N/A
https://support.apple.com/en-us/HT213533	N/A
http://seclists.org/fulldisclosure/2022/Dec/20	mailing-list
http://seclists.org/fulldisclosure/2022/Dec/21	mailing-list
http://seclists.org/fulldisclosure/2022/Dec/23	mailing-list
http://seclists.org/fulldisclosure/2022/Dec/26	mailing-list
http://seclists.org/fulldisclosure/2022/Dec/24	mailing-list
http://packetstormsecurity.com/files/170518/libCoreEntitlements-CEContextQuery-Arbitrary-Entitlement-Returns.html	N/A

Hyperlink: https://support.apple.com/kb/HT213536

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213535

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213532

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213530

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213531

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213533

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/20

Resource:

mailing-list

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/21

Resource:

mailing-list

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/23

Resource:

mailing-list

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/26

Resource:

mailing-list

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/24

Resource:

mailing-list

Hyperlink: http://packetstormsecurity.com/files/170518/libCoreEntitlements-CEContextQuery-Arbitrary-Entitlement-Returns.html

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://support.apple.com/kb/HT213536	x_transferred
https://support.apple.com/en-us/HT213535	x_transferred
https://support.apple.com/en-us/HT213532	x_transferred
https://support.apple.com/en-us/HT213530	x_transferred
https://support.apple.com/en-us/HT213531	x_transferred
https://support.apple.com/en-us/HT213533	x_transferred
http://seclists.org/fulldisclosure/2022/Dec/20	mailing-list x_transferred
http://seclists.org/fulldisclosure/2022/Dec/21	mailing-list x_transferred
http://seclists.org/fulldisclosure/2022/Dec/23	mailing-list x_transferred
http://seclists.org/fulldisclosure/2022/Dec/26	mailing-list x_transferred
http://seclists.org/fulldisclosure/2022/Dec/24	mailing-list x_transferred
http://packetstormsecurity.com/files/170518/libCoreEntitlements-CEContextQuery-Arbitrary-Entitlement-Returns.html	x_transferred

Hyperlink: https://support.apple.com/kb/HT213536

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213535

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213532

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213530

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213531

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213533

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/20

Resource:

mailing-list

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/21

Resource:

mailing-list

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/23

Resource:

mailing-list

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/26

Resource:

mailing-list

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2022/Dec/24

Resource:

mailing-list

x_transferred

Hyperlink: http://packetstormsecurity.com/files/170518/libCoreEntitlements-CEContextQuery-Arbitrary-Entitlement-Returns.html

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-269	CWE-269 Improper Privilege Management

Type: CWE

CWE ID: CWE-269

Description: CWE-269 Improper Privilege Management

Metrics

Version	Base score	Base severity	Vector
3.1	7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Version: 3.1

Base score: 7.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected Products

Affected

Affected

Affected

Affected

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References