CVE-2022-25366 - CVE House
Back to Database
Status published High CVE-2022-25366

Cryptomator through 1.6.5 allows DYLIB injection because, although it has...

Vulnerability Description

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious .dylib file that can be executed via the DYLD_INSERT_LIBRARIES environment variable.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-25366

Credits & Attribution

No credits recorded in the NVD database.

References

More from cryptomator

View All →
CVE-2023-39520
Cryptomator vulnerable to Local Elevation of Privileges
Medium 5.5
CVE-2023-37907
Cryptomator's MSI installer allows local privilege escalation
High 7

Affected Vendor

cryptomator

View all reports →

Affected Software

cryptomator
Vulnerable Versions:
0

Timeline

Official Publish: February 19th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.