Lucene search

[email protected]CVE-2009-1700

HistoryJun 10, 2009 - 6:00 p.m.

CVE-2009-1700

2009-06-1018:00:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2009-1700

xslt

webkit

apple safari

iphone os

security vulnerability

xml content

remote attack

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

7.6 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.1%

JSON

The XSLT implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read XML content from arbitrary web pages via a crafted document.

Affected configurations

NVD

Node

applesafariRange≤3.2.2

applesafariMatch2.0

applesafariMatch2.0.0

applesafariMatch2.0.1

applesafariMatch2.0.2

applesafariMatch2.0.3

applesafariMatch2.0.3417.8

applesafariMatch2.0.3417.9

applesafariMatch2.0.3417.9.2

applesafariMatch2.0.3417.9.3

applesafariMatch2.0.4

applesafariMatch3.0

applesafariMatch3.0.0

applesafariMatch3.0.0b

applesafariMatch3.0.1

applesafariMatch3.0.1beta

applesafariMatch3.0.1b

applesafariMatch3.0.2

applesafariMatch3.0.2b

applesafariMatch3.0.3

applesafariMatch3.0.3b

applesafariMatch3.0.4

applesafariMatch3.0.4b

applesafariMatch3.1.0

applesafariMatch3.1.0b

applesafariMatch3.1.1

applesafariMatch3.1.2

applesafariMatch3.2.0

applesafariMatch3.2.1

Node

appleiphone_osMatch1.0.0

appleiphone_osMatch1.0.1

appleiphone_osMatch1.0.2

appleiphone_osMatch1.1.0

appleiphone_osMatch1.1.1

appleiphone_osMatch1.1.2

appleiphone_osMatch1.1.3

appleiphone_osMatch1.1.4

appleiphone_osMatch1.1.5

appleiphone_osMatch2.0

appleiphone_osMatch2.0.0

appleiphone_osMatch2.0.1

appleiphone_osMatch2.0.2

appleiphone_osMatch2.1

appleiphone_osMatch2.1.1

appleiphone_osMatch2.2

appleiphone_osMatch2.2.1

AND

appleipod_touch

appleiphone_os

CPENameOperatorVersion
apple:safariapple safarile3.2.2
apple:safariapple safarieq2.0
apple:safariapple safarieq2.0.0
apple:safariapple safarieq2.0.1
apple:safariapple safarieq2.0.2
apple:safariapple safarieq2.0.3
apple:safariapple safarieq2.0.4
apple:safariapple safarieq3.0
apple:safariapple safarieq3.0.0
apple:safariapple safarieq3.0.0b

CPE	Name	Operator	Version
apple:safari	apple safari	le	3.2.2
apple:safari	apple safari	eq	2.0
apple:safari	apple safari	eq	2.0.0
apple:safari	apple safari	eq	2.0.1
apple:safari	apple safari	eq	2.0.2
apple:safari	apple safari	eq	2.0.3
apple:safari	apple safari	eq	2.0.4
apple:safari	apple safari	eq	3.0
apple:safari	apple safari	eq	3.0.0
apple:safari	apple safari	eq	3.0.0b