2 lines
3.5 KiB
JSON
2 lines
3.5 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["MacOS"],"product":"DaVinci Resolve","vendor":"Blackmagic Design Inc","versions":[{"lessThan":"19.1.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3."},{"lang":"es","value":"Se descubrió que DaVinci Resolve en MacOS se instaló con permisos de archivo incorrectos (rwxrwxrwx). Esto es incompatible con las prácticas de seguridad estándar de macOS, donde las aplicaciones deben tener permisos drwxr-xr-x. Los permisos incorrectos permiten el secuestro de Dylib. Las cuentas de invitado, otros usuarios y aplicaciones pueden aprovechar esta vulnerabilidad para la escalada de privilegios. Este problema afecta a DaVinci Resolve en MacOS en versiones anteriores a la 19.1.3."}],"id":"CVE-2025-1413","lastModified":"2026-06-17T08:39:05.490","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-28T13:18:32.916960Z","version":"2.0.3"}}]},"published":"2025-02-28T09:15:11.850","references":[{"source":"cvd@cert.pl","url":"https://apps.apple.com/pl/app/davinci-resolve/id571213070?mt=12"},{"source":"cvd@cert.pl","url":"https://cert.pl/en/posts/2025/02/CVE-2025-1413/"},{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2025/02/CVE-2025-1413/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"cvd@cert.pl","type":"Secondary"}]}
|