CVE-2004-0922: Apple Mac OS X

Medium severity, CVSS 5.0. EPSS: 1% chance of exploitation in the next 30 days.

AFP Server on Mac OS X 10.3.x to 10.3.5, under certain conditions, does not properly set the guest group ID, which causes AFP to change a write-only AFP Drop Box to be read-write when the Drop Box is on a share that is mounted by a guest, which allows attackers to read the Drop Box.

Affected products

• Apple Mac OS X: version 10.2 only; version 10.2.1 only; version 10.2.2 only; version 10.2.3 only; version 10.2.4 only; version 10.2.5 only; …
• Apple Mac OS X Server: version 10.2 only; version 10.2.1 only; version 10.2.2 only; version 10.2.3 only; version 10.2.4 only; version 10.2.5 only; …
• Apple Quicktime: version 5.0.2 only; version 6.0 only; version 6.1 only; version 6.5 only; version 6.5.1 only

Published 2005-01-27. Last modified 2026-06-16.