PT-2021-18948 · Apple+6 · Apple Macos+6

Published 2021-08-24 · Updated 2023-01-09 · CVE-2021-30897

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 12.0.1

Description An issue existed in the specification for the resource timing API, which allowed a malicious website to exfiltrate data cross-origin. The specification was updated, and the updated specification was implemented to fix this issue.

Recommendations For macOS versions prior to 12.0.1, update to macOS Monterey 12.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the resource timing API until the update is applied.

Exploit

Fix

Related Identifiers

ALSA-2022:1777

ALT-PU-2021-3571

ALT-PU-2022-2162

CESA-2022_1777

CVE-2021-30897

OPENSUSE-SU-2022:0182-1

OPENSUSE-SU-2022_0182-1

OPENSUSE-SU-2022_0182-2

RHSA-2022:1777

RHSA-2022_1777

RHSA-2025:10364

RLSA-2022:1777

SUSE-SU-2022:0142-1

SUSE-SU-2022:0182-1

SUSE-SU-2022:0182-2

SUSE-SU-2022:0183-1

Affected Products

Alt Linux

Almalinux

Centos

Apple Macos

Red Hat

Rocky Linux

Suse

References · 165

• 🔥 https://github.com/springsec/CVE-2022-22620 · Exploit
• 🔥 https://github.com/kmeps4/CVE-2022-22620 · Exploit
• 🔥❌ https://github.com/PeterMxx/ps4_8.00_vuln_poc · Exploit, Deleted
• https://osv.dev/vulnerability/SUSE-SU-2022:0142-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0182-2 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:1777 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-30897 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-1777.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:1777 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:1777 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30897 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30897 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0182-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-1777.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0182-1 · Vendor Advisory