CVE-2021-30713
Apple macOS Unspecified Vulnerability
Description
CVE-2021-30713 is a HIGH macOS Unspecified Vulnerability affecting Apple macOS, carrying a CVSS 3.1 score of 7.8. A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.. Affected products include Mac Os X (>= 10.15, <= 10.15.7; 10.15.7), Macos (< 11.4). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.00186 (40.35th percentile), this vulnerability should still be remediated promptly given its KEV catalog listing and confirmed exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | mac os x | >= 10.15, <= 10.15.7; 10.15.7 |
| apple | macos | < 11.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2021/Sep/40(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/HT212529(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT212805(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30713(Third Party Advisory, US Government Resource)
Weakness Type
CWE-862: Missing Authorization
CVE-2021-30713 is classified under CWE-862 — Missing Authorization. Missing Authorization occurs when a product does not perform an authorization check when an actor attempts to access a resource or perform an action. Without proper authorization validation, an attacker may be able to access data or carry out actions that should be restricted, potentially bypassing authentication mechanisms entirely.
In the context of Apple macOS, this weakness is particularly dangerous because missing authorization checks allow malicious applications or actors to bypass intended access controls and privacy protections. When authorization validation is absent, any process or application with basic access can escalate privileges or access restricted resources without proper consent or verification. This class of vulnerability has been repeatedly exploited to circumvent security boundaries in operating systems and platform-level protections.
Learn more: CWE-862 — Missing Authorization
Impact Analysis
CVE-2021-30713 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker extensive access to sensitive data processed by Apple macOS, including protected system information, user data, and potentially credentials or tokens stored within the affected environment.
Integrity (HIGH): Attackers can modify critical system files, bypass security controls, alter configurations, or deploy malicious payloads on affected Apple macOS systems.
Availability (HIGH): Complete disruption of the affected service or system is possible, including denial of service, system crashes, or rendering Apple macOS inoperable.
Scope Unchanged: The vulnerability's scope is Unchanged (U), meaning exploitation is contained within the vulnerable component. The impact, while significant, is limited to the Apple macOS environment itself.
With an EPSS score of 0.00186 (40.35th percentile), this vulnerability demonstrates notable exploitation probability and warrants prompt remediation.
Exploit Maturity
CVE-2021-30713 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited, as confirmed by its inclusion in the KEV catalog. The EPSS score of 0.00186 (40.35th percentile) confirms real-world exploitation despite a relatively lower statistical probability.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2021-30713. However, the confirmed exploitation in the wild means threat actors are actively using this vulnerability in attacks.
Attack surface: The local attack vector requires the attacker to have local access or to trick a user into executing malicious content. While this limits the attack surface compared to network-based vulnerabilities, social engineering and malicious application distribution remain effective delivery mechanisms.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the vendor advisory for specific patch guidance and verify the patch addresses CVE-2021-30713 in your specific product version.
- Verify affected product versions in your environment. Identify all instances of Apple macOS in your infrastructure (affected versions: Mac Os X (>= 10.15, <= 10.15.7; 10.15.7), Macos (< 11.4)). Use asset inventory and vulnerability scanning tools to ensure no instances are missed.
- Implement interim mitigations if patching is delayed. If immediate patching is not feasible, apply compensating controls such as restricting access to the affected component, enabling enhanced logging and monitoring, and enforcing least-privilege principles for running applications.
- Scan for signs of prior exploitation. Given the confirmed active exploitation of this vulnerability, review system logs and security monitoring data for evidence of compromise. Conduct a thorough investigation if any suspicious activity is detected.
- Update detection signatures and monitoring rules. Ensure intrusion detection and prevention systems, endpoint detection tools, and SIEM rules are updated to detect exploitation attempts targeting CVE-2021-30713.
- Conduct a post-remediation review. After patching, verify the fix is effective and document the remediation actions taken. Update your vulnerability management records and assess whether any additional hardening measures are warranted.
Technical Details
CVE-2021-30713 is a HIGH-severity vulnerability in Apple macOS that can be exploited locally, requiring either local system access or user interaction with malicious content. The attack complexity is low, meaning no specialized conditions or preparation are required beyond the attack prerequisites. Low-level privileges are required, meaning the attacker needs basic authenticated access. No user interaction is required, enabling fully automated exploitation.
Technical mechanism: A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.. The underlying flaw relates to missing authorization, where missing Authorization occurs when a product does not perform an authorization check when an actor attempts to access a resource or perform an action. Without proper authorization validation, an attacker may be able to access data or carry out actions that should be restricted, potentially bypassing authentication mechanisms entirely.
Affected products: Apple Mac Os X (>= 10.15, <= 10.15.7; 10.15.7), Apple Macos (< 11.4)
CVSS 3.1 vector analysis: The vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects an Attack Vector of LOCAL, Attack Complexity of LOW, Privileges Required of LOW, User Interaction of NONE, Scope UNCHANGED, and impact ratings of HIGH/HIGH/HIGH for Confidentiality/Integrity/Availability respectively.
Frequently Asked Questions
What is CVE-2021-30713?
CVE-2021-30713 is a HIGH-severity vulnerability (CVSS 7.8) in Apple macOS. Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences. It is listed in CISA's Known Exploited Vulnerabilities catalog, confirming real-world exploitation.
Which products are affected by CVE-2021-30713?
The affected products include Mac Os X (>= 10.15, <= 10.15.7; 10.15.7), Macos (< 11.4). Organizations running any of these versions should verify their exposure and prioritize remediation. Check vendor advisories for the complete and most current list of affected versions.
How do I fix CVE-2021-30713?
Apply updates per vendor instructions. Ensure all affected instances of Apple macOS are identified using vulnerability scanning and asset management tools. If immediate patching is not possible, implement compensating controls and enhanced monitoring. After patching, verify the fix and scan for indicators of prior compromise.
How severe is CVE-2021-30713?
CVE-2021-30713 is rated HIGH with a CVSS 3.1 score of 7.8. Its EPSS score of 0.00186 places it in the 40.35th percentile for exploitation likelihood. The vulnerability has confirmed active exploitation in the wild and was required to be remediated by federal agencies by 2021-11-17 per CISA's KEV directive.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.