Actively exploited · Published Sep 8, 2021 · Assigned by apple

CVE-2021-30657

Medium 5.5 Exploited

In plain English

A medium-severity missing authorization in macOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 68.5% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)68.5%top 0.7% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..

Affected products (as reported)

Vendor	Product	Versions
Apple	macOS	unspecified – before 11.3
Apple	macOS	unspecified – before 2021

Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://support.apple.com/en-us/HT212325 x_refsource_MISC
https://support.apple.com/en-us/HT212326 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30657 government-resource