Vulnerability Description
Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Anaconda | Anaconda3 | < 2024.06-1 |
| Apple | Macos | - |
Related Weaknesses (CWE)
References
- https://m8sec.dev/blog/privilege-escalation-macos-pkg-installers/ExploitThird Party Advisory
- https://www.anaconda.com/docs/getting-started/anaconda/release/2024.x#anaconda-2Release Notes
FAQ
What is CVE-2024-46060?
CVE-2024-46060 is a vulnerability with a CVSS score of 7.8 (HIGH). Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created a...
How severe is CVE-2024-46060?
CVE-2024-46060 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-46060?
Check the references section above for vendor advisories and patch information. Affected products include: Anaconda Anaconda3, Apple Macos.