PT-2009-5176 · Google+1 · Google Chrome+1
Jan Lieskovsky
·
Publicado
2009-11-13
·
Atualizado
2021-11-08
·
CVE-2009-2816
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Apple Safari versions prior to 4.0.4
Google Chrome versions prior to 3.0.195.33
Description
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight. This makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page. WebKit sends a preflight request to the server for access to the resource and includes custom HTTP headers specified by the requesting page in the preflight request.
Recommendations
For Apple Safari versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue.
For Google Chrome versions prior to 3.0.195.33, update to version 3.0.195.33 or later to resolve the issue.
As a temporary workaround, consider restricting access to custom HTTP headers in preflight requests until a patch is available.
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Google Chrome
Safari