CVE-2025-4280

May 23, 2025, 3:55 p.m.

4.8
Medium

Description

MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Poedit, potentially disguising attacker's malicious intent. This issue has been fixed in 3.6.3 version of Poedit.

Product(s) Impacted

Vendor Product Versions
Poedit
  • Poedit
  • 3.6.3

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a poedit poedit 3.6.3 / / / / / / /

References

https://cert.pl/en/posts/2025/05/CVE-2025-4280
https://cert.pl/posts/2025/05/CVE-2025-4280
https://github.com/vslavik/poedit
https://github.com/vslavik/poedit/security/advisories/GHSA-8fcw-v6gr-hp34
https://poedit.net

Tags

cvd@cert.pl
CWE-276
2025-05-22
CVE-2025-4280

CVSS Score

4.8 / 10

CVSS Data - 4.0

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: LOW
  • Integrity Impact: LOW
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: May 22, 2025, 10:15 a.m.
Last Modified: May 23, 2025, 3:55 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cvd@cert.pl

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.