CVE-2021-1815: apple ios and ipados Path Traversal

Vulnerability summary

CVE-2021-1815 is a medium (CVSS 5.5) Path Traversal vulnerability in apple ios and ipados. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.7% of scored vulnerabilities.

Timeline

1. 08-09-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A local user may be able to modify protected parts of the file system.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.