Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

macOS Before 10.13: Installer Fails to Restrict Access to FileVault Key

CVE-2017-13837 · published 8 years ago
Summary

A security issue exists in older macOS versions. An app may be able to access sensitive data, specifically the FileVault unlock key, by exploiting a weakness in the Installer component. To protect your system, upgrade to macOS 10.13 or later.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple mac_os_x 10.13.0
cpe:2.3:o:apple:mac_os_x:10.13.0:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Installer" component. It does not properly restrict an app's entitlements for accessing th...
An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Installer" component. It does not properly restrict an app's entitlements for accessing the FileVault unlock key.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Timeline
Published3 Apr 2018
Updated3 Nov 2026
First seen14 Mar 2026
Sources
CVE-2017-13837 · OSV
CVE-2017-13837 · NVD
Track software like this
Free during beta