CVE-2017-7149

An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "StorageKit" component. It allows attackers to discover passwords for APFS encrypted volumes by reading Disk Utility hints, because the stored hint value was accidentally set to the password itself, not the entered hint value.

• http://www.securityfocus.com/bid/101178Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039513Third Party Advisory, VDB Entry
• https://hackernoon.com/new-macos-high-sierra-vulnerability-exposes-the-password-of-an-encrypted-apfs-container-b4f2f5326e79Exploit, Third Party Advisory
• https://nakedsecurity.sophos.com/2017/10/05/urgent-update-your-mac-again-right-now/Exploit, Technical Description, Third Party Advisory
• https://support.apple.com/HT208165Vendor Advisory
• https://www.theregister.co.uk/2017/10/05/apple_patches_password_hint_bug_that_revealed_password/Exploit, Press/Media Coverage, Third Party Advisory
• http://www.securityfocus.com/bid/101178Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039513Third Party Advisory, VDB Entry
• https://hackernoon.com/new-macos-high-sierra-vulnerability-exposes-the-password-of-an-encrypted-apfs-container-b4f2f5326e79Exploit, Third Party Advisory
• https://nakedsecurity.sophos.com/2017/10/05/urgent-update-your-mac-again-right-now/Exploit, Technical Description, Third Party Advisory
• https://support.apple.com/HT208165Vendor Advisory
• https://www.theregister.co.uk/2017/10/05/apple_patches_password_hint_bug_that_revealed_password/Exploit, Press/Media Coverage, Third Party Advisory

Published

Oct 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7143An issue was discovered in certain Apple products. macOS bef…
• CVE-2017-7144An issue was discovered in certain Apple products. iOS befor…
• CVE-2017-7145An issue was discovered in certain Apple products. iOS befor…
• CVE-2017-7146An issue was discovered in certain Apple products. iOS befor…
• CVE-2017-7147An issue was discovered in certain Apple products. The Apple…
• CVE-2017-7148An issue was discovered in certain Apple products. iOS befor…
• CVE-2017-7150An issue was discovered in certain Apple products. macOS bef…
• CVE-2017-7151A race condition was addressed with additional validation. T…
• CVE-2017-7152An issue was discovered in certain Apple products. iOS befor…
• CVE-2017-7153An issue was discovered in certain Apple products. iOS befor…
• CVE-2017-7154An issue was discovered in certain Apple products. iOS befor…
• CVE-2017-7155An issue was discovered in certain Apple products. macOS bef…