CVE-2008-3611 json
Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by po…
published 2008-09-16 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3597
- cvss
- 6.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new password on the same login screen.
Patch / fix
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.3 | AV:L/AC:M/Au:N/C:N/I:C/A:C |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
securityfocus.com
/bid/31189
vdb-entry, patch
-
lists.apple.com
/archives/security-announce//2008/Sep/msg00005.html
vendor-advisory
-
vupen.com
/english/advisories/2008/2584
vdb-entry, vendor-advisory
-
secunia.com
/advisories/31882
third-party-advisory, vendor-advisory
-
us-cert.gov
/cas/techalerts/TA08-260A.html
third-party-advisory, us-government-resource
-
securitytracker.com
/id?1020878
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/45171
vdb-entry
Sources
- CVE List CVE-2008-3611
- NVD CVE-2008-3611
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.