CVE

Id
36176  
CVE No.
CVE-2008-6059  
Status
Candidate  
Description
xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.  
Phase
Assigned (20090204)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
396463 36176 CVE-2008-6059 CONFIRM:http://trac.webkit.org/changeset/38566/trunk/WebCore/xml/XMLHttpRequest.cpp  View
396464 36176 CVE-2008-6059 CONFIRM:https://bugs.webkit.org/show_bug.cgi?id=10957  View
396465 36176 CVE-2008-6059 BID:33804  View
396466 36176 CVE-2008-6059 URL:http://www.securityfocus.com/bid/33804  View
396467 36176 CVE-2008-6059 XF:webkit-xmlhttprequest-info-disclosure(48575)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
40346 JVNDB-2009-001352 Microsoft Word 2007 における情報漏洩の脆弱性 Microsoft Word 2007 には、"PDF で保存する" 機能を有効にしている場合、"PDF でメール送信する" の操作を実行している際、Subject フィールドに絶対パス名がセットされるため、情報漏洩の脆弱性が存在します。 CVE-2008-6063 36176 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001352.html  View