PT-2009-1534 · Apple · Webkit

Robert Sesek · Publicado 2009-02-05 · Atualizado 2017-08-08 · CVE-2008-6059

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebKit before r38566

Description The issue allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, due to improper restriction of access to the Set-Cookie and Set-Cookie2 HTTP response headers. This is related to the HTTPOnly protection mechanism.

Recommendations For WebKit before r38566, update to a version after r38566 to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-6059

Produtos afetados

Webkit

Referências · 5

• http://securityfocus.com/bid/33804 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48575 · Nota
• http://trac.webkit.org/changeset/38566/trunk/WebCore/xml/XMLHttpRequest.cpp · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6059 · Nota de Segurança
• https://bugs.webkit.org/show_bug.cgi?id=10957 · Nota