CVE-2023-42845: 
macOS vulnerability analysis and mitigation

CVE-2023-42845 is an authentication vulnerability affecting Apple's Photos application in iOS 17.1, iPadOS 17.1, and macOS Sonoma 14.1. The vulnerability was discovered by Bistrit Dahal and disclosed on October 25, 2023. The issue allows unauthorized access to photos stored in the Hidden Photos Album without proper authentication (Apple Support).

The vulnerability stems from an authentication issue in the Photos application that was addressed with improved state management. The issue has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-306: Missing Authentication for Critical Function (NVD).

The primary impact of this vulnerability is that an attacker may be able to view photos stored in the Hidden Photos Album without proper authentication. This represents a significant privacy concern as Hidden Photos Album is specifically designed to keep sensitive images private (Apple Support).

The vulnerability affects iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, iPad mini 5th generation and later, and macOS Sonoma systems prior to the security updates (Apple Support, Apple Support).

Apple has addressed this vulnerability by releasing security updates in iOS 17.1, iPadOS 17.1, and macOS Sonoma 14.1. Users are advised to update their devices to these versions to protect against unauthorized access to their Hidden Photos Album (Apple Support).