CVE-2020-3882: 
macOS vulnerability analysis and mitigation

CVE-2020-3882 is a security vulnerability affecting the Calendar application in macOS Catalina versions prior to 10.15.5. The vulnerability was discovered by Andy Grant of NCC Group and was fixed by Apple in the macOS Catalina 10.15.5 update released on May 26, 2020 (Apple Advisory).

The vulnerability stems from insufficient checks in the Calendar application's handling of calendar invitations. The issue was addressed by Apple with improved validation checks in macOS Catalina 10.15.5. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

When exploited, this vulnerability allows a remote attacker to exfiltrate user information through maliciously crafted calendar invitations. The vulnerability specifically impacts the confidentiality of user data, with no direct effect on system integrity or availability (Apple Advisory).

The vulnerability requires user interaction in the form of importing a maliciously crafted calendar invitation. The attack can be executed remotely, requiring no privileges, though it does need the user to interact with the malicious calendar invitation (NVD).

The vulnerability was patched in macOS Catalina 10.15.5. Users should update their systems to this version or later to protect against this vulnerability. The fix involves improved checks in the Calendar application's handling of calendar invitations (Apple Advisory).