Skip to content
Fencer Vulns
high 7.2

CVE-2008-2830 json

Open Scripting Architecture in Apple Mac OS X 10.4.11 and 10.5.4, and some other 10.4 and 10.5 versions, does not properly restrict the loa…

published 2008-06-23 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-2823

cvss
7.2
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits
1
Exploit-DB

Summary

Open Scripting Architecture in Apple Mac OS X 10.4.11 and 10.5.4, and some other 10.4 and 10.5 versions, does not properly restrict the loading of scripting addition plugins, which allows local users to gain privileges via scripting addition commands to a privileged application, as originally demonstrated by an osascript tell command to ARDAgent.

Timeline

  1. First public exploit (EDB-31940)
  2. Published

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-31940 Apple Mac OSX 10.x - Applescript ARDAgent Shell Privilege Escalation local, 2008-06-19
  • securityfocus.com http://www.securityfocus.com/bid/29831 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.