Apple iOS and iPadOS: An attacker in a privileged network position may be able to bypass…
Priority LOW 33Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 3 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS.
Why it matters now
EPSS 0.02231 82nd percentileScored 2026-11-07
Fix Partial iOS and iPadOS (Apple): 14.8tvOS (Apple): 15+3 more productsRed Hat: 2 advisoriesRed Hat: 3 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apple | iOS and iPadOS | before 14.8 | 14.8 | Patch available | CNA |
| Apple | tvOS | before 15 | 15 | Patch available | CNA |
| Apple | Safari | before 15 | 15 | Patch available | CNA |
| Apple | watchOS | before 8 | 8 | Patch available | CNA |
| Apple | macOS | before 12.0 | 12.0 | Patch available | CNA |
- iOS and iPadOS VendorApple Affected before 14.8 Fixed in 14.8 Patch available CNA
- tvOS VendorApple Affected before 15 Fixed in 15 Patch available CNA
- Safari VendorApple Affected before 15 Fixed in 15 Patch available CNA
- watchOS VendorApple Affected before 8 Fixed in 8 Patch available CNA
- macOS VendorApple Affected before 12.0 Fixed in 12.0 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | before 15.0.0 | Vulnerable | Apple |
| cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | before 14.8 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | before 14.8 | Vulnerable | Apple |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | before 12.0.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | before 15.0 | Vulnerable | Apple |
| cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | before 8.0 | Vulnerable | Apple |
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* Versions before 15.0.0 Vulnerable ·Apple
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 14.8 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 14.8 Vulnerable ·Apple
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 12.0.1 Vulnerable ·Apple
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* Versions before 15.0 Vulnerable ·Apple
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* Versions before 8.0 Vulnerable ·Apple
Remediation
- Fix · CNA iOS and iPadOS (Apple) Fixed in 14.8
- Fix · CNA tvOS (Apple) Fixed in 15
- Fix · CNA Safari (Apple) Fixed in 15
- Fix · CNA watchOS (Apple) Fixed in 8
- Fix · CNA macOS (Apple) Fixed in 12.0
Red Hat 2 advisories
- RHSA-2025:10364 Released 2025-07-07 · Red Hat rating Importantwebkitgtk4 security update
- Red Hat Enterprise Linux Server (v. 7 ELS) webkitgtk4-2.48.3-2.el7_9, webkitgtk4-devel-2.48.3-2.el7_9, webkitgtk4-jsc-2.48.3-2.el7_9 +1
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) webkitgtk4-devel-2.48.3-2.el7_9, webkitgtk4-doc-2.48.3-2.el7_9, webkitgtk4-jsc-devel-2.48.3-2.el7_9
- RHSA-2022:1777 Released 2022-05-10 · Red Hat rating Moderatewebkit2gtk3 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3-2.34.6-1.el8, webkit2gtk3-devel-2.34.6-1.el8, webkit2gtk3-jsc-2.34.6-1.el8 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apple tvOS, watchOS 15, 8
9 records Highest priority Priority MEDIUM 2 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2021-11192 Type confusion in Apple iOS and iPadOSPriority MEDIUM 41
- TI-2021-11184 Use after free in Apple iOS and iPadOSPriority MEDIUM 41
- TI-2021-11212 Apple iOS and iPadOS: Processing a maliciously crafted dfont file may lead to arbitrary…Priority LOW 36
- Release ·
Apple macOS 12.0
5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2021-11206 Apple macOS: Unpacking a maliciously crafted archive may allow an attacker to write…Priority MEDIUM 53
- TI-2021-11197 Out-of-bounds write in Apple macOSPriority LOW 36
- TI-2021-11195 Apple macOS: A malicious application may be able to execute arbitrary code with kernel…Priority LOW 36
Show 2 more groups
- Release ·
Apple iOS and iPadOS 14.8
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2021-11192 Type confusion in Apple iOS and iPadOSPriority MEDIUM 41
- TI-2021-11207 Apple iOS and iPadOS: Processing a malicious audio file may result in unexpected…Priority LOW 36
- TI-2021-11209 Out-of-bounds read in Apple iOS and iPadOSPriority LOW 27
- Release ·
Apple Safari 15
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-11192 Type confusion in Apple iOS and iPadOSPriority MEDIUM 41
- TI-2021-11184 Use after free in Apple iOS and iPadOSPriority MEDIUM 41
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:1777 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:10364 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2025:10364 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-30823
- 2026-10-03 Alias added: GHSA-fmvg-g54p-g6qj
References
Advisory 7
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/kb/HT212953
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
More Apple Ipados vulnerabilities
- TI-2025-28008 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
- TI-2025-22441 Apple iOS and iPadOS: An attacker with arbitrary read and write capability may be able to… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-22440 Memory corruption in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
- TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
- TI-2025-17847 Use after free in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
- TI-2022-06854 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-30823 · CVE Program
- CVE-2021-30823 · NVD
- FIRST EPSS
- GHSA-fmvg-g54p-g6qj · GitHub Advisory Database · CC BY 4.0
- CVE-2021-30823 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences