CVE-2018-6823

In the VPN client in Mailbutler Shimo before 4.1.5.1 on macOS, the com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service that can be abused to execute scripts as root.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-02-07

Last modified

2024-09-17

Affected products

• Shimo (Mailbutler)

References

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-001.md