« Volver al listado

CVE-2011-3436

Estado: ModificadaMedia (6.5)—

Open Directory in Apple Mac OS X 10.7 before 10.7.2 does not require a user to provide the current password before changing this password, which allows remote attackers to bypass intended password-change restrictions by leveraging an unattended workstation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Apple — MAC OS XApple — MAC OS X Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-3436",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-10-14T10:55:11.197",
  "references": [
    {
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://osvdb.org/76370",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://support.apple.com/kb/HT5002",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/50085",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70585",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/76370",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.apple.com/kb/HT5002",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/50085",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70585",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open Directory in Apple Mac OS X 10.7 before 10.7.2 does not require a user to provide the current password before changing this password, which allows remote attackers to bypass intended password-change restrictions by leveraging an unattended workstation."
    },
    {
      "lang": "es",
      "value": "Open Directory en Apple Mac OS X v10.7 antes v10.7.2 no requiere que el usuario proporcione el password actual antes de cambiar la contraseña, lo que permite a atacantes remotos evitar restricciones intencionadas de cambio de contraseña aprovechando una estación de trabajo sin supervisión."
    }
  ],
  "lastModified": "2026-06-16T23:33:17.267",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8961F444-48C4-4B54-829B-A1A2D0F2716C"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09A0FA11-6211-4962-A6E0-F00732818012"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38823717-65A1-4587-8F05-32EA9A01084C"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BD4E77C-3F87-476B-BB66-75EECDFDB18E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@apple.com"
}