CVE-2023-32370 - Vulnerability Details - OpenCVE

A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Policy to block domains with wildcards may fail.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Apple	Macos
Redhat	Enterprise Linux
Webkitgtk	Webkitgtk
Wpewebkit	Wpe Webkit

Configuration 1 [-]

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:a:webkitgtk:webkitgtk::::::::
	cpe:2.3:a:wpewebkit:wpe_webkit::::::::

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
webkit2gtk3-0:2.40.5-1.el8	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:7055	2023-11-14T00:00:00Z
Red Hat Enterprise Linux 9
webkit2gtk3-0:2.40.5-1.el9	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:6535	2023-11-07T00:00:00Z

References

Link	Providers
http://www.openwall.com/lists/oss-security/2023/09/11/1
https://nvd.nist.gov/vuln/detail/CVE-2023-32370
https://security.gentoo.org/glsa/202401-04
https://support.apple.com/en-us/HT213670
https://webkitgtk.org/security/WSA-2023-0008.html
https://www.cve.org/CVERecord?id=CVE-2023-32370

History

Mon, 30 Sep 2024 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2023-09-06T01:36:31.884Z

Updated: 2025-02-13T16:50:38.290Z

Reserved: 2023-05-08T22:31:41.818Z

Link: CVE-2023-32370

Vulnrichment

Updated: 2024-08-02T15:10:24.917Z

NVD

Status : Modified

Published: 2023-09-06T02:15:09.070

Modified: 2024-11-21T08:03:13.227

Link: CVE-2023-32370

Redhat

Severity : Moderate

Publid Date: 2023-09-06T00:00:00Z

Links: CVE-2023-32370 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6D636F7-278A-491B-8960-91A4D5A86A96", "versionEndExcluding": "13.3", "versionStartIncluding": "13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*", "matchCriteriaId": "A007F029-38D8-4D0D-8DF2-A2F6CB9ADE60", "versionEndExcluding": "2.40.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C1E75F9-1855-4668-8E78-2A6F0F4FCBA1", "versionEndExcluding": "2.40.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Policy to block domains with wildcards may fail."}, {"lang": "es", "value": "Se abord\u00f3 un problema de l\u00f3gica con una comprobaci\u00f3n mejorada. Este problema es corregido en macOS Ventura 13.3. La pol\u00edtica de seguridad de contenido para bloquear dominios con wildcards podr\u00eda fallar."}], "id": "CVE-2023-32370", "lastModified": "2024-11-21T08:03:13.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-06T02:15:09.070", "references": [{"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/09/11/1"}, {"source": "product-security@apple.com", "url": "https://security.gentoo.org/glsa/202401-04"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/HT213670"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/09/11/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202401-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/HT213670"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:7055", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "webkit2gtk3-0:2.40.5-1.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-11-14T00:00:00Z"}, {"advisory": "RHSA-2023:6535", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "webkit2gtk3-0:2.40.5-1.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}], "bugzilla": {"description": "webkitgtk: content security policy blacklist failure", "id": "2238944", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238944"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "verified"}, "details": ["A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Policy to block domains with wildcards may fail.", "A vulnerability was found in webkit. A logic issue was addressed with improved validation."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2023-32370", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "webkitgtk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "webkitgtk4", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2023-09-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-32370\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-32370\nhttps://webkitgtk.org/security/WSA-2023-0008.html"], "statement": "This flaw is rated as 'Moderate' as the WebKitGTK package is shipped as a dependency for the Gnome package. Additionally, Red Hat Enterprise Linux doesn't ship any WebKitGTK based web browser where this flaw would present a higher severity major threat.", "threat_severity": "Moderate"}