CVE-2023-42874: 
macOS vulnerability analysis and mitigation

CVE-2023-42874 is a security vulnerability affecting macOS Sonoma versions prior to 14.2, discovered by Don Clarke and disclosed on December 11, 2023. The vulnerability allows secure text fields to be displayed via the Accessibility Keyboard when using a physical keyboard (Apple Advisory, Full Disclosure).

The vulnerability stems from a state management issue in the Accessibility feature of macOS Sonoma. Apple addressed this security flaw by implementing improved state management mechanisms. The vulnerability has been assigned a CVSS v3.1 base score of 2.4 LOW (Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) (NVD).

The vulnerability could potentially expose sensitive information by displaying secure text fields through the Accessibility Keyboard when a physical keyboard is in use (Apple Advisory).

The vulnerability requires physical access to the affected system to be exploited, with no need for special privileges or user interaction, as indicated by the CVSS metrics (NVD).

Apple has addressed this vulnerability in macOS Sonoma 14.2, released on December 11, 2023. Users are advised to update their systems to this version or later to mitigate the security risk (Apple Advisory).