Vulnerability Description
Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before accepting the connection. Thus any low privileged user can connect and call external methods defined in XPC service as root, elevating their privilege to the highest level.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netskope | Netskope | < 89 |
| Apple | Macos | - |
Related Weaknesses (CWE)
References
- https://www.netskope.com/company/security-compliance-and-assurance/netskope-secuPatchVendor Advisory
- https://www.netskope.com/company/security-compliance-and-assurance/netskope-secuPatchVendor Advisory
FAQ
What is CVE-2021-41388?
CVE-2021-41388 is a vulnerability with a CVSS score of 7.8 (HIGH). Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before...
How severe is CVE-2021-41388?
CVE-2021-41388 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-41388?
Check the references section above for vendor advisories and patch information. Affected products include: Netskope Netskope, Apple Macos.