Vulnerability · Published Apr 30, 2024 · Assigned by GitHub_M

CVE-2024-22405XADMaster may not apply quarantine attribute correctly to extracted files

Medium 5.5

In plain English

A medium-severity security flaw in XADMaster from MacPaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.

Affected products (as reported)

Vendor	Product	Versions
MacPaw	XADMaster	< 1.10.8

Weakness: CWE-281 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://github.com/MacPaw/XADMaster/security/advisories/GHSA-xg3c-r7w5-7xw2 x_refsource_CONFIRM
https://github.com/MacPaw/XADMaster/commit/b75c05bc3bca9e183ecd3c512e270ce93006da3c x_refsource_MISC