CVE-2017-13872
Estado: ModificadaAlta (8.1)—💥 Exploit
Se ha descubierto un problema en algunos productos Apple. Las versiones de macOS High Sierra anteriores a la actualización de seguridad 2017-001 se han visto afectadas. El problema implica el componente "Directory Utility". Esto permite que los atacantes obtengan acceso de administrador sin contraseña mediante ciertas interacciones relacionadas con la entrada del nombre de usuario root.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 37%
- Percentil entre todas las CVEs puntuadas: 98
- Fecha de la puntuación: 9/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Módulo de Metasploit (exploit fiable y al alcance de cualquiera) · Mac OS X Root Privilege Escalation
- Publicado en Exploit-DB · Apple macOS 10.13.1 (High Sierra) - 'Blank Root' Local Privilege Escalation (Metasploit) (30/11/2017)
- Publicado en Exploit-DB · Apple macOS 10.13.1 (High Sierra) - 'Blank Root' Local Privilege Escalation (28/11/2017)
- Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub
⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.
Tecnologías afectadas (1)
CWE
- CWE-287
Referencias
- http://www.securityfocus.com/bid/101981
- http://www.securitytracker.com/id/1039875
- https://arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/
- https://github.com/rapid7/metasploit-framework/pull/9302
- https://objective-see.com/blog/blog_0x24.html
- https://support.apple.com/HT208315
- https://support.apple.com/HT208331
- https://www.exploit-db.com/exploits/43201/
- https://www.exploit-db.com/exploits/43248/
- https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/
- http://www.securityfocus.com/bid/101981
- http://www.securitytracker.com/id/1039875
- https://arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/
- https://github.com/rapid7/metasploit-framework/pull/9302
- https://objective-see.com/blog/blog_0x24.html
- https://support.apple.com/HT208315
- https://support.apple.com/HT208331
- https://www.exploit-db.com/exploits/43201/
- https://www.exploit-db.com/exploits/43248/
- https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/
JSON original (NVD)
Mostrar
{
"id": "CVE-2017-13872",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "product-security@apple.com",
"affectedData": [
{
"vendor": "n/a",
"product": "macOS High Sierra",
"versions": [
{
"status": "affected",
"version": "macOS High Sierra"
}
]
}
]
}
],
"published": "2017-11-29T17:29:00.217",
"references": [
{
"url": "http://www.securityfocus.com/bid/101981",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "product-security@apple.com"
},
{
"url": "http://www.securitytracker.com/id/1039875",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "product-security@apple.com"
},
{
"url": "https://arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://github.com/rapid7/metasploit-framework/pull/9302",
"source": "product-security@apple.com"
},
{
"url": "https://objective-see.com/blog/blog_0x24.html",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT208315",
"tags": [
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/HT208331",
"source": "product-security@apple.com"
},
{
"url": "https://www.exploit-db.com/exploits/43201/",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "product-security@apple.com"
},
{
"url": "https://www.exploit-db.com/exploits/43248/",
"source": "product-security@apple.com"
},
{
"url": "https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/",
"tags": [
"Press/Media Coverage",
"Third Party Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "http://www.securityfocus.com/bid/101981",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1039875",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/rapid7/metasploit-framework/pull/9302",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://objective-see.com/blog/blog_0x24.html",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT208315",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.apple.com/HT208331",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/43201/",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/43248/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/",
"tags": [
"Press/Media Coverage",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the \"Directory Utility\" component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user name."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en algunos productos Apple. Las versiones de macOS High Sierra anteriores a la actualización de seguridad 2017-001 se han visto afectadas. El problema implica el componente \"Directory Utility\". Esto permite que los atacantes obtengan acceso de administrador sin contraseña mediante ciertas interacciones relacionadas con la entrada del nombre de usuario root."
}
],
"lastModified": "2026-06-17T01:05:19.153",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.13.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F3DDB99-A585-427A-9236-9ACC85660116"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.13.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA2B9E19-1CC5-4168-9B1F-0068384C10D9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "product-security@apple.com"
}