CVE-2021-1801
published 2021-04-02CVE-2021-1801: This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security…
PriorityP179medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.52%
71.7th percentile
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_14.4_and_ipados | — | — |
| apple | ios_and_ipados | >= unspecified < 14.4 | 14.4 |
| apple | ipad_os | < 14.4 | 14.4 |
| apple | iphone_os | < 14.4 | 14.4 |
| apple | macos | >= 11.0.1 < 11.2 | 11.2 |
| apple | macos | >= unspecified < 11.2 | 11.2 |
| apple | macos | >= unspecified < 7.3 | 7.3 |
| apple | macos | >= unspecified < 14.4 | 14.4 |
| apple | macos_big_sur_11.2_security_update_2021-001_catalina_security_update_2021-001_mo | — | — |
| apple | tvos | < 14.4 | 14.4 |
| apple | watchos | < 7.3 | 7.3 |
| debian | webkit2gtk | < webkit2gtk 2.30.6-1 (bookworm) | webkit2gtk 2.30.6-1 (bookworm) |
| debian | wpewebkit | < webkit2gtk 2.30.6-1 (bookworm) | webkit2gtk 2.30.6-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| webkitgtk | webkitgtk | < 2.30.6 | 2.30.6 |
Detection & IOCsextracted from sources · hover to see the quote
- ·Vulnerability affects WebKitGTK and WPE WebKit versions prior to 2.30.6; versions 2.30.6 and later are fixed. Red Hat Enterprise Linux 9 (webkit2gtk3) is listed as not affected. ↗
- ·The highest threat from this vulnerability is to data integrity (not confidentiality or availability), which should inform triage prioritization. ↗
- ·Fixed in Debian across all tracked branches (bookworm, bullseye, forky, sid, trixie) at webkit2gtk version 2.30.6-1. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.5MEDIUM
vulncheck6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-99vx-wqpw-hqrq: This issue was addressed with improved iframe sandbox enforcement
ghsa_unreviewed·2022-05-24
CVE-2021-1801 [MEDIUM] GHSA-99vx-wqpw-hqrq: This issue was addressed with improved iframe sandbox enforcement
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
OSV
CVE-2021-1801: This issue was addressed with improved iframe sandbox enforcement
osv·2021-04-02·CVSS 6.5
CVE-2021-1801 [MEDIUM] CVE-2021-1801: This issue was addressed with improved iframe sandbox enforcement
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
VulnCheck
Apple macOS iframe Sandboxing Vulnerability
vulncheck·2021·CVSS 6.5
CVE-2021-1801 [MEDIUM] Apple macOS iframe Sandboxing Vulnerability
Apple macOS iframe Sandboxing Vulnerability
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
Affected: Apple ipados
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.confiant.com/hubfs/ScamClub-Threat-Report-Q1Q2-2023.pdf
Ubuntu
WebKitGTK vulnerabilities
vendor_ubuntu·2021-03-29
CVE-2021-1765 WebKitGTK vulnerabilities
Title: WebKitGTK vulnerabilities
Summary: Several security issues were fixed in WebKitGTK.
A large number of security issues were discovered in the WebKitGTK Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.
Red Hat
webkitgtk: IFrame sandboxing policy violation
vendor_redhat·2021-03-22·CVSS 6.5
CVE-2021-1801 [MEDIUM] CWE-863 webkitgtk: IFrame sandboxing policy violation
webkitgtk: IFrame sandboxing policy violation
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Maliciously crafted web content may violate the iframe sandboxing policy. The highest threat from this vulnerability is to data integrity.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Out of support scope
Package: webkitgtk3 (Red Hat Enterprise Linux 7) - Out of support scope
Package: webkit2gtk3 (Red Hat Enterprise Linux 9) - Not affected
Apple
CVE-2021-1801: macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave
vendor_apple·2021-02-01·CVSS 6.5
CVE-2021-1801 [MEDIUM] CVE-2021-1801: macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave
Apple Security Update: About the security content of macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave
Product: macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave
CVE: CVE-2021-1801
Component: WebKit
Impact: Maliciously crafted web content may violate iframe sandboxing policy
Description: This issue was addressed with improved iframe sandbox enforcement.
Apple
CVE-2021-1801: iOS 14.4 and iPadOS 14.4
vendor_apple·2021-01-26·CVSS 6.5
CVE-2021-1801 [MEDIUM] CVE-2021-1801: iOS 14.4 and iPadOS 14.4
Apple Security Update: About the security content of iOS 14.4 and iPadOS 14.4
Product: iOS 14.4 and iPadOS
Version: 14.4
CVE: CVE-2021-1801
Component: WebKit
Impact: Maliciously crafted web content may violate iframe sandboxing policy
Description: This issue was addressed with improved iframe sandbox enforcement.
Debian
CVE-2021-1801: webkit2gtk - This issue was addressed with improved iframe sandbox enforcement. This issue is...
vendor_debian·2021·CVSS 6.5
CVE-2021-1801 [MEDIUM] CVE-2021-1801: webkit2gtk - This issue was addressed with improved iframe sandbox enforcement. This issue is...
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
Scope: local
bookworm: resolved (fixed in 2.30.6-1)
bullseye: resolved (fixed in 2.30.6-1)
forky: resolved (fixed in 2.30.6-1)
sid: resolved (fixed in 2.30.6-1)
trixie: resolved (fixed in 2.30.6-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/https://security.gentoo.org/glsa/202104-03https://support.apple.com/en-us/HT212146https://support.apple.com/en-us/HT212147https://support.apple.com/en-us/HT212148https://support.apple.com/en-us/HT212149https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/https://security.gentoo.org/glsa/202104-03https://support.apple.com/en-us/HT212146https://support.apple.com/en-us/HT212147https://support.apple.com/en-us/HT212148https://support.apple.com/en-us/HT212149
2021-04-02
Published
Exploited in the wild