PT-2007-1938 · Apple · Webcore

Published 2007-01-25 · Updated 2018-10-16 · CVE-2007-0478

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebCore versions 10.3.9 through 10.4.10

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by embedding certain HTML tags within an HTML comment in TITLE elements, which can bypass some XSS protection schemes.

Recommendations For versions 10.3.9 through 10.4.10, consider disabling the parsing of HTML comments in TITLE elements as a temporary workaround until a patch is available. Restrict access to potentially vulnerable WebCore components to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-0478

Affected Products

Webcore

References · 12

• http://secunia.com/advisories/26235 · Vendor Advisory
• http://secunia.com/advisories/23893 · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0478 · Security Note
• http://securitytracker.com/id?1018494 · Note
• http://vupen.com/english/advisories/2007/2732 · Note
• http://securityfocus.com/bid/25159 · Note
• http://beanfuzz.com/wordpress/?p=99 · Note
• http://osvdb.org/32712 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31846 · Note
• http://docs.info.apple.com/article.html?artnum=306172 · Note
• http://securityfocus.com/archive/1/457763/100/0/threaded · Note