Cyber Resilience

CVE-2023-42823

Apple Macos 12.0 – 12.7.1

Published
21 February 2024
Modified
04 November 2025
Patch / advisory
View advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score 0.0043 35th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2023-42823 is a medium-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Apple Macos. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.1. An app may be able…

more

to access user-sensitive data.

CWE(s)
CWE-922

Related Threats

CVEs Like This One

CVE-2023-27942Same product: Apple Ipados
CVE-2024-23290Same product: Apple Ipados
CVE-2024-54541Same product: Apple Ipados
CVE-2024-23217Same product: Apple Ipados
CVE-2023-32415Same product: Apple Ipados
CVE-2023-42839Same product: Apple Iphone Os
CVE-2025-24117Same product: Apple Ipados
CVE-2024-40813Same product: Apple Ipados
CVE-2024-27789Same product: Apple Ipados
CVE-2022-48618Same product: Apple Ipados

Affected Assets

apple
ipados
17.0 · ≤ 16.7.2
apple
iphone os
17.0 · ≤ 16.7.2
apple
macos
14.0 · 12.0 — 12.7.1 · 13.0 — 13.6.1
apple
tvos
≤ 17.1
apple
watchos
≤ 10.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CM-12 Information Location
addresses: CWE-922

Tracking information locations and access supports secure storage practices instead of insecure ones.

CP-6 Alternate Storage Site
addresses: CWE-922

Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.

CP-9 System Backup
addresses: CWE-922

Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.

PM-17 Protecting Controlled Unclassified Information on External Systems
addresses: CWE-922

Policy explicitly addresses insecure storage of CUI on external systems, requiring compliant handling and protections.

RA-2 Security Categorization
addresses: CWE-922

Proper categorization drives selection of storage controls that keep sensitive information from being stored insecurely.

SC-28 Protection of Information at Rest
addresses: CWE-922

The control explicitly requires secure storage mechanisms for sensitive information, closing the insecure-storage weakness class.

SI-23 Information Fragmentation
addresses: CWE-922

Storing information as fragments on distinct components is an architectural control that avoids insecure single-location storage of the complete sensitive data set.

SR-7 Supply Chain Operations Security
addresses: CWE-922

OPSEC requirements improve handling and storage practices for sensitive supply-chain information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforces least-privilege permissions and authorization reviews that limit read/write access to stored sensitive data.

PR.DS-01 mostly match
prevents

Directly protects data-at-rest confidentiality via encryption or access controls that prevent unauthorized reads.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.10 Storage media none match
none

Secure reuse and disposal procedures, including cryptographic wiping and physical destruction, stop the insecure storage of sensitive data on media that may later be accessed by unauthorized actors.

A.7.14 Secure disposal or re-use of equipment none match
none

Mandating secure disposal techniques stops the insecure retention of sensitive information on storage media that leaves organizational control.

References