PT-2021-18918 · Apple · Macos Big Sur+1

Andy Grant + 6 · Published 2021-04-26 · Updated 2022-03-25 · CVE-2021-30856

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions macOS Big Sur versions prior to 11.3

Description A malicious unsandboxed app on a system with Remote Login enabled may bypass Privacy preferences. This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions.

Recommendations For versions prior to 11.3, update to macOS Big Sur 11.3 to resolve the issue. As a temporary workaround, consider disabling Remote Login until the update is applied.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-30856

Affected Products

Apple Macos

Macos Big Sur

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-30856 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30856 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30856 · Note
• https://support.apple.com/en-us/103126 · Note
• https://support.apple.com/en-us/HT212325 · Note