CVE-2020-27937: 
macOS vulnerability analysis and mitigation

A logic issue in macOS's Directory Utility component was discovered and addressed with improved state management. The vulnerability (CVE-2020-27937) was reported by Wojciech Reguła (@_r3ggi) of SecuRing and affected macOS Big Sur 11.0.1, macOS Catalina 10.15.7, and macOS Mojave. The issue was fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, and Security Update 2021-001 Mojave (Apple Support).

The vulnerability was classified with a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. This indicates that the vulnerability requires local access and user interaction to exploit, but could result in high confidentiality impact without affecting integrity or availability (NVD).

When exploited, this vulnerability could allow a malicious application to access private information on the affected system. The issue specifically affected the Directory Utility component of macOS, potentially exposing sensitive data to unauthorized access (Apple Support).

The vulnerability requires local access and user interaction to exploit. It is one of several TCC-related bypass vulnerabilities discovered in macOS, following CVE-2020-9934 and preceding CVE-2021-30970 (Hacker News).

Apple addressed this vulnerability by implementing improved state management in the Directory Utility component. The fix was released as part of macOS Big Sur 11.2, Security Update 2021-001 Catalina, and Security Update 2021-001 Mojave (Apple Support).