CVE-2017-13890

—

CVSS 3.0

7.4 high

EPSS

1%p66

Published

Apr 3, 2018 (Apr 3, 2018)

Modified

Jun 17, 2026

Description

An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. macOS before 10.13 is affected. The issue involves the "CoreTypes" component. It allows remote attackers to trigger disk-image mounting via a crafted web site.

Vendors: apple
Products: mac os x
Weakness: CWE-20
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news2 stories

Chaining 3 zero-days allowed pen testers to hack Apple macOS computers

Security AffairsNov 22, 20:25 UTC · Nov 22, 2018Exploit / PoC CVE-2017-13890 CVE-2018-4176 CVE-2018-4175

How Just Opening A Site In Safari Could Have Hacked Your Apple macOS

The Hacker NewsNov 22, 08:52 UTC · Nov 22, 2018Exploit / PoC CVE-2017-13890 CVE-2018-4176 CVE-2018-4175