Information disclosure in macOS - CVE-2022-32879

Vulnerability identifier: #VU68669

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-32879

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper state management in Notifications. An attacker with physical access to device can access contacts from the lock screen.

macOS
iPadOS
Apple iOS
watchOS
tvOS

Install updates from vendor's website.

macOS - update to 13.0 22A380
iPadOS - addressed in versions 15.7 19H12, 16.0 20A362
Apple iOS - addressed in versions 15.7 19H12, 16.0 20A362
watchOS - update to 9.0 20R361
tvOS - update to 16.0 20J373

• https://support.apple.com/en-us/HT213488

• Multiple vulnerabilities in Apple macOS Ventura
• Multiple vulnerabilities in Apple tvOS
• Multiple vulnerabilities in Apple watchOS
• Multiple vulnerabilities in Apple iOS and iPadOS
• Multiple vulnerabilities in Apple iOS 16 and iPadOS 16