NVD

Id
48966  
Name
CVE-2009-1697  
Description
CRLF injection vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site scripting (XSS) attacks that depend on communication with arbitrary web sites on the same server through use of XMLHttpRequest without a Host header.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-06-10  
Modified Date
2011-02-17  
Seq
2009-1697  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
247492 48966 CVE-2009-1697 APPLE-SA-2009-06-08-1  View
247493 48966 CVE-2009-1697 APPLE-SA-2009-06-17-1  View
247494 48966 CVE-2009-1697 SUSE-SR:2011:002  View
247495 48966 CVE-2009-1697 1022344  View
247496 48966 CVE-2009-1697 http://support.apple.com/kb/HT3613  View
247497 48966 CVE-2009-1697 http://support.apple.com/kb/HT3639  View
247498 48966 CVE-2009-1697 DSA-1950  View
247499 48966 CVE-2009-1697 35260  View
247500 48966 CVE-2009-1697 ADV-2009-1522  View
247501 48966 CVE-2009-1697 ADV-2009-1621  View
247502 48966 CVE-2009-1697 ADV-2011-0212  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40766 JVNDB-2009-001772 複数の Apple 製品における XMLHttpRequest の処理に関する CRLF インジェクションの脆弱性 複数の Apple 製品の WebKit には、HTML ドキュメントの処理に不備があることにより、HTTP ヘッダを注入され、同一生成元ポリシーを回避される脆弱性が存在します。 CVE-2009-1697 39128 CVE-2009-1697 48966 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001772.html 2009-06-08 2009-07-17 View