cnvd - cnvd-2021-40763

cnvd-2021-40763

Vulnerability from cnvd

Title: Apple macOS Big Sur输入验证错误漏洞

Description:

Apple macOS Big Sur是美国苹果（Apple）公司的一个手机应用APP。

macOS Big Sur存在输入验证错误漏洞，该漏洞源于TCC子系统内未能充分验证用户提供的输入,恶意应用程序可以绕过隐私首选项，获取敏感信息。目前没有详细的漏洞细节提供。

Severity: 中

Patch Name: Apple macOS Big Sur输入验证错误漏洞的补丁

Patch Description:

Apple macOS Big Sur是美国苹果（Apple）公司的一个手机应用APP。

macOS Big Sur存在输入验证错误漏洞，该漏洞源于TCC子系统内未能充分验证用户提供的输入,恶意应用程序可以绕过隐私首选项，获取敏感信息。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://support.apple.com/en-us/HT212529

Reference: https://www.cybersecurity-help.cz/vdb/SB2021052415

Impacted products

Name
['Apple MacOS 11.0 20A2411', 'Apple MacOS 11.0.1 20B29', 'Apple MacOS 11.0.1 20B50', 'Apple MacOS 11.1 20C69', 'Apple MacOS 11.2 20D64', 'Apple MacOS 11.2.1 20D74', 'Apple MacOS 11.2.1 20D75', 'Apple MacOS 11.2.2 20D80', 'Apple MacOS 11.2.3 20D91', 'Apple MacOS 11.3 20E232', 'Apple MacOS 11.3.1 20E241']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-30713"
    }
  },
  "description": "Apple macOS Big Sur\u662f\u7f8e\u56fd\u82f9\u679c\uff08Apple\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u624b\u673a\u5e94\u7528APP\u3002\n\nmacOS Big Sur\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eTCC\u5b50\u7cfb\u7edf\u5185\u672a\u80fd\u5145\u5206\u9a8c\u8bc1\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165,\u6076\u610f\u5e94\u7528\u7a0b\u5e8f\u53ef\u4ee5\u7ed5\u8fc7\u9690\u79c1\u9996\u9009\u9879\uff0c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://support.apple.com/en-us/HT212529",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-40763",
  "openTime": "2021-06-10",
  "patchDescription": "Apple macOS Big Sur\u662f\u7f8e\u56fd\u82f9\u679c\uff08Apple\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u624b\u673a\u5e94\u7528APP\u3002\r\n\r\nmacOS Big Sur\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eTCC\u5b50\u7cfb\u7edf\u5185\u672a\u80fd\u5145\u5206\u9a8c\u8bc1\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165,\u6076\u610f\u5e94\u7528\u7a0b\u5e8f\u53ef\u4ee5\u7ed5\u8fc7\u9690\u79c1\u9996\u9009\u9879\uff0c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apple macOS Big Sur\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e \u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apple  MacOS 11.0 20A2411",
      "Apple  MacOS 11.0.1 20B29",
      "Apple  MacOS 11.0.1 20B50",
      "Apple  MacOS 11.1 20C69",
      "Apple  MacOS 11.2 20D64",
      "Apple  MacOS 11.2.1 20D74",
      "Apple  MacOS 11.2.1 20D75",
      "Apple  MacOS 11.2.2 20D80",
      "Apple  MacOS 11.2.3 20D91",
      "Apple  MacOS 11.3 20E232",
      "Apple  MacOS 11.3.1 20E241"
    ]
  },
  "referenceLink": "https://www.cybersecurity-help.cz/vdb/SB2021052415",
  "serverity": "\u4e2d",
  "submitTime": "2021-05-28",
  "title": "Apple macOS Big Sur\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2021-30713 (GCVE-0-2021-30713)

Vulnerability from cvelistv5

Published

2021-09-08 14:29

Modified

2025-07-30 01:38

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.

Summary

A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..

References

▼	URL	Tags
	https://support.apple.com/en-us/HT212529	x_refsource_MISC
	https://support.apple.com/kb/HT212805	x_refsource_CONFIRM
	http://seclists.org/fulldisclosure/2021/Sep/40	mailing-list, x_refsource_FULLDISC

Impacted products

	Vendor	Product	Version
	Apple	macOS	Version: unspecified < 11.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:40:32.057Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT212529"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT212805"
          },
          {
            "name": "20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2021/Sep/40"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-30713",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T17:25:34.672209Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30713"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:38:00.808Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2021-30713 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-21T23:06:30.000Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.apple.com/en-us/HT212529"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT212805"
        },
        {
          "name": "20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2021/Sep/40"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2021-30713",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "macOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "11.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apple"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.apple.com/en-us/HT212529",
              "refsource": "MISC",
              "url": "https://support.apple.com/en-us/HT212529"
            },
            {
              "name": "https://support.apple.com/kb/HT212805",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT212805"
            },
            {
              "name": "20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2021/Sep/40"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2021-30713",
    "datePublished": "2021-09-08T14:29:13.000Z",
    "dateReserved": "2021-04-13T00:00:00.000Z",
    "dateUpdated": "2025-07-30T01:38:00.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted