CVE-2010-1760

2010-08-1922:00:01

CWE-255

apple

web.nvd.nist.gov

cve-2010-1760

webcore

webkit

xmlhttprequest

security vulnerability

credentials

remote attack vectors

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

8.4

Confidence

High

EPSS

0.01

Percentile

83.5%

JSON

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in WebCore in WebKit before r58409 does not properly handle credentials during a cross-origin synchronous request, which has unspecified impact and remote attack vectors, aka rdar problem 7905150.

Affected configurations

Nvd

Node

applewebkitRange≤r58408

applewebkitMatchr50173

applewebkitMatchr56187

applewebkitMatchr56188

applewebkitMatchr56379

VendorProductVersionCPE
applewebkitr56379cpe:/a:apple:webkit:r56379:::
applewebkitr56187cpe:/a:apple:webkit:r56187:::
applewebkitr56188cpe:/a:apple:webkit:r56188:::
applewebkitcpe:/a:apple:webkit::::
applewebkitr50173cpe:/a:apple:webkit:r50173:::

Vendor	Product	Version	CPE
apple	webkit	r56379	cpe:/a:apple:webkit:r56379:::
apple	webkit	r56187	cpe:/a:apple:webkit:r56187:::
apple	webkit	r56188	cpe:/a:apple:webkit:r56188:::
apple	webkit		cpe:/a:apple:webkit::::
apple	webkit	r50173	cpe:/a:apple:webkit:r50173:::