VULNERABILITY INTELLIGENCE

CVE-2015-5836

CVSS score4.3 MEDIUM

EPSS probability1.44%

CISA KEVNot currently listed

Published2015-10-09

Last modified2026-06-17

CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N

Description

Apple Online Store Kit in Apple OS X before 10.11 improperly validates iCloud keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.

Weakness classification

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

product-security@apple.com — Vendor Advisory
product-security@apple.com — Third Party Advisory, VDB Entry
product-security@apple.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory