PT-2021-7320 · Apple+7 · Watchos+12

Prakash · Published 2021-04-13 · Updated 2023-01-09 · CVE-2021-30888

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WPE WebKit versions prior to the fixed version iOS versions prior to 15.1 iPadOS versions prior to 15.1 macOS Monterey versions prior to 12.0.1 iOS versions prior to 14.8.1 iPadOS versions prior to 14.8.1 tvOS versions prior to 15.1 watchOS versions prior to 8.1

Description The issue is related to an information leakage problem in the WPE WebKit module, which is connected to the use of open redirects. A malicious website using Content Security Policy reports may be able to leak information via redirect behavior. This could allow a remote attacker to access confidential data.

Recommendations For WPE WebKit, update to a version that includes the fix for this issue. For iOS, update to version 15.1 or later. For iPadOS, update to version 15.1 or later. For macOS Monterey, update to version 12.0.1 or later. For iOS, update to version 14.8.1 or later. For iPadOS, update to version 14.8.1 or later. For tvOS, update to version 15.1 or later. For watchOS, update to version 8.1 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALSA-2022:1777

ALT-PU-2021-3571

ALT-PU-2022-2162

BDU:2022-05675

CESA-2022_1777

CVE-2021-30888

DSA-4995-1

DSA-4996-1

OPENSUSE-SU-2022:0182-1

OPENSUSE-SU-2022_0182-1

OPENSUSE-SU-2022_0182-2

RHSA-2022:1777

RHSA-2022_1777

RHSA-2025:10364

RLSA-2022:1777

SUSE-SU-2022:0142-1

SUSE-SU-2022:0182-1

SUSE-SU-2022:0182-2

SUSE-SU-2022:0183-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Apple Macos

Red Hat

Rocky Linux

Suse

Ios

Ipados

Macos Monterey

Tvos

Watchos

References · 180

• 🔥 https://github.com/springsec/CVE-2022-22620 · Exploit
• 🔥 https://github.com/kmeps4/CVE-2022-22620 · Exploit
• 🔥❌ https://github.com/PeterMxx/ps4_8.00_vuln_poc · Exploit, Deleted
• https://osv.dev/vulnerability/ALSA-2022:1777 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-1777.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-30888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30888 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05675 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30888 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0182-2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-30888 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-30888 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4995-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-1777.html · Vendor Advisory