5.5

CVE-2021-30855

A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, iOS 15 and iPadOS 15, watchOS 8, macOS Big Sur 11.6. An application may be able to access restricted files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ iPadOS Version < 14.8
Apple ≫ iPhone OS Version < 14.8
Apple ≫ macOS X Version < 10.15.7
Apple ≫ macOS X Version 10.15.7 Update -
Apple ≫ macOS X Version 10.15.7 Update security_update_2020-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-001
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-002
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-003
Apple ≫ macOS X Version 10.15.7 Update security_update_2021-004
Apple ≫ macOS X Version 10.15.7 Update supplemental_update
Apple ≫ macOS Version < 11.6
Apple ≫ tvOS Version < 15.0
Apple ≫ watchOS Version < 8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.4% 0.823
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://support.apple.com/kb/HT212815
https://support.apple.com/en-us/HT212814
https://support.apple.com/en-us/HT212819
https://support.apple.com/en-us/HT212807
https://support.apple.com/en-us/HT212804
https://support.apple.com/en-us/HT212805