CVE-2024-23746: Code Injection

Published Feb 2, 2024

Updated

Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents).

Affected Software

2 affected components

All of the following

Miro Miro=0.8.18

macOS

Event History

Feb 2, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-23746?

CVE-2024-23746 is considered a significant vulnerability due to its potential for code injection on macOS.

How do I fix CVE-2024-23746?

To mitigate CVE-2024-23746, ensure that you are using the latest version of Miro Desktop and follow best security practices for macOS.

What are the potential impacts of CVE-2024-23746?

CVE-2024-23746 could allow attackers to execute arbitrary code on affected systems if exploited.

Which versions of Miro Desktop are affected by CVE-2024-23746?

CVE-2024-23746 specifically affects Miro Desktop version 0.8.18.

Is macOS inherently vulnerable due to CVE-2024-23746?

No, macOS itself is not inherently vulnerable, but the specific configuration of Miro Desktop version 0.8.18 on macOS can lead to exploitation.