Universal cross-site scripting in Apple Safari - CVE-2021-1825

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU52643

Universal cross-site scripting in Apple Safari - CVE-2021-1825

Published: April 27, 2021 / Updated: June 3, 2021


Vulnerability identifier: #VU52643
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2021-1825
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Affected software

Apple Safari
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
watchOS
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
macOS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
tvOS
iPadOS
Apple iOS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Basesystem
Cloud Pak for Security (CP4S)
iCloud for Windows
WebKitGTK+
Web Terminal
libwebkit2gtk3-lang
libjavascriptcoregtk-4_0-18
libjavascriptcoregtk-4_0-18-debuginfo
libwebkit2gtk-4_0-37
libwebkit2gtk-4_0-37-debuginfo
typelib-1_0-JavaScriptCore-4_0
typelib-1_0-WebKit2-4_0
typelib-1_0-WebKit2WebExtension-4_0
webkit2gtk-4_0-injected-bundles
webkit2gtk-4_0-injected-bundles-debuginfo
webkit2gtk3-debugsource
webkit2gtk3-devel
webkitgtk4 (Red Hat package)
iTunes

How to mitigate CVE-2021-1825

Install updates from vendor's website.

Apple Safari - update to 14.1
Cloud Pak for Security (CP4S) - update to 1.8.0.0
WebKitGTK+ - update to 2.32.1
watchOS - update to 7.4 18T195
macOS - update to 11.3 20E232
tvOS - update to 14.5 18L204
iPadOS - update to 14.5 18E199
Apple iOS - update to 14.5 18E199
Web Terminal - update to 1.3
libwebkit2gtk3-lang - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
libjavascriptcoregtk-4_0-18 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
libjavascriptcoregtk-4_0-18-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
libwebkit2gtk-4_0-37 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
libwebkit2gtk-4_0-37-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
typelib-1_0-JavaScriptCore-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
typelib-1_0-WebKit2-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
typelib-1_0-WebKit2WebExtension-4_0 - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkit2gtk-4_0-injected-bundles - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkit2gtk-4_0-injected-bundles-debuginfo - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkit2gtk3-debugsource - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkit2gtk3-devel - addressed in versions 2.34.3-2.82.1, 2.34.3-3.92.1, 2.34.3-23.3
webkitgtk4 (Red Hat package) - update to 2.48.3-2.el7_9
iCloud for Windows - update to 12.3
iTunes - update to 12.11.3

External References

Related Security Bulletins