CVE-2021-30823

Description

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• v2.0•MEDIUM•Score: 4AV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.17%• Percentile: 39%

Affected Systems

• apple•ios and ipados

  ≥ unspecified, < 14.8

• apple•ipados

  < 14.8

• apple•iphone_os

  < 14.8

• apple•macos

  < 12.0.1 | ≥ unspecified, < 12.0

• apple•safari

  < 15.0.0 | ≥ unspecified, < 15

• apple•tvos

  < 15.0 | ≥ unspecified, < 15

• apple•watchos

  < 8.0 | ≥ unspecified, < 8

References (7)

• https://support.apple.com/en-us/HT212807
• https://support.apple.com/en-us/HT212819
• https://support.apple.com/en-us/HT212815
• https://support.apple.com/en-us/HT212816
• https://support.apple.com/en-us/HT212869
• https://support.apple.com/kb/HT212953
• http://www.openwall.com/lists/oss-security/2021/12/20/6