LiveActive security incident?Get immediate response
CVE Record

CVE-2023-42946: This issue was addressed with improved redaction of sensitive information.

This issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to leak sensitive user information.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-42946 is an Apple information disclosure issue. Apple says an app may be able to leak sensitive user information, and fixed it with improved redaction in iOS/iPadOS 17.1, macOS Sonoma 14.1, watchOS 10.1, and tvOS 17.1.

Executive priority

Prioritize this in normal high-severity Apple patch cycles, especially for managed mobile and macOS fleets handling sensitive data. The urgency is confidentiality-driven, but the provided sources do not support emergency active-exploitation language.

Technical view

The public record describes a sensitive-information redaction flaw affecting Apple iOS/iPadOS, macOS, watchOS, and tvOS. CVSS 3.1 is 7.5 with high confidentiality impact and no integrity or availability impact. The bundle does not provide CWE, exact affected version ranges, exploit details, or root-cause depth.

Likely exposure

Exposure is most likely on Apple devices that have not reached the fixed releases named by Apple. Exact vulnerable versions are unspecified in the provided sources, so inventory should key off installed OS versions and Apple advisory coverage rather than inferred product ranges.

Exploitation context

The source bundle does not show CISA KEV listing or any cited evidence of active exploitation. Treat exploitation status as unconfirmed, not actively exploited, based on the available evidence.

Researcher notes

Public details are sparse. Apple identifies the impact as sensitive user information leakage by an app and the fix as improved redaction. No CWE, affected version ranges, proof-of-concept status, or exploit telemetry are provided in the bundle.

Mitigation direction

  • Update iOS and iPadOS devices to 17.1 or later where supported.
  • Update macOS Sonoma systems to 14.1 or later where supported.
  • Update watchOS devices to 10.1 or later where supported.
  • Update tvOS devices to 17.1 or later where supported.
  • Check Apple guidance for unsupported devices or deployment-specific constraints.

Validation and detection

  • Inventory Apple OS versions across managed endpoints and mobile devices.
  • Confirm affected platforms are at or beyond the Apple fixed releases.
  • Review MDM compliance reports for stale or unmanaged Apple devices.
  • Document exceptions where devices cannot receive the named fixed versions.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-42946 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2023-42946Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
AppletvOSunspecifiedListed
ApplemacOSunspecifiedListed
ApplewatchOSunspecifiedListed
AppleiOS and iPadOSunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.