CVE-2021-30671: 
macOS vulnerability analysis and mitigation

CVE-2021-30671 is a validation issue in macOS that was discovered and reported by Ryan Bell (@iRyanBell). The vulnerability was fixed in macOS Big Sur 11.4 and Security Update 2021-003 Catalina, released on May 24, 2021. The vulnerability affected macOS Big Sur versions prior to 11.4 and macOS Catalina (Apple Security, Apple Catalina).

The vulnerability exists in the TCC (Transparency, Consent, and Control) component of macOS, where a validation issue could allow unauthorized Apple events to be sent to Finder. The issue was addressed with improved logic implementation. The vulnerability has a CVSS v3.1 base score of 3.3 (LOW) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating local access is required and the impact is primarily to integrity (NVD).

A malicious application may be able to send unauthorized Apple events to Finder, potentially leading to unauthorized access or manipulation of the Finder application (Apple Security).

Apple addressed this vulnerability by implementing improved logic in the TCC component. Users should update to macOS Big Sur 11.4 or install Security Update 2021-003 Catalina to protect against this vulnerability (Apple Security, Apple Catalina).