Actively exploited · Published Sep 8, 2021 · Assigned by apple

CVE-2021-30713

High 7.8 Exploited

In plain English

A high-severity missing authorization in macOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 7.0% (higher than 94% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)7.0%top 5.8% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..

Affected products (as reported)

Vendor	Product	Versions
Apple	macOS	unspecified – before 11.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://support.apple.com/en-us/HT212529 x_refsource_MISC
https://support.apple.com/kb/HT212805 x_refsource_CONFIRM
20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina mailing-list, x_refsource_FULLDISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30713 government-resource