CVE-2021-30856 — Incorrect Authorization in Apple Macos

CWE-863 — Incorrect Authorization2 documents2 sources
Severity
9.1CRITICALNVD
EPSS
0.3%
top 50.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple MacosApple Macos BIG SUR
Timeline
Latest updateApr 26
PublishedAug 24

Description

This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions. This issue is fixed in macOS Big Sur 11.3. A malicious unsandboxed app on a system with Remote Login enabled may bypass Privacy preferences.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages3 packages

▶CVEListV5apple/macosunspecified — 11.3
▶NVDapple/macos11.0 — 11.3

📋Vendor Advisories

1
Apple
CVE-2021-30856: macOS Big Sur 11.3↗2021-04-26
▶