Potential security risk in iMovie by Apple due to improper entitlement handling
CVE-2021-30757

5.5MEDIUM

Key Information:

Vendor

Apple
Status
Imovie
Vendor
CVE Published:
8 September 2021

What is CVE-2021-30757?

A security vulnerability in iMovie allows potential exploitation due to improper management of entitlements and privacy permissions. If a malicious application gains access to these permissions, it can lead to unauthorized actions or data exposure. To mitigate this risk, Apple has addressed the issue by enabling a hardened runtime, with the fix provided in version 10.2.4. It is crucial for users to update to this version to protect against potential vulnerabilities.

Affected Version(s)

iMovie < 10.2

References

https://support.apple.com/en-us/HT212549
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.