CVEvulnerability
CVE-2007-2401
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2007-06-25
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function. NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.
Affected configurations
• apple mac os x 10.3.9
• apple mac os x 10.4.9
• apple mac os x server 10.3.9
• apple mac os x server 10.4.9
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://docs.info.apple.com/article.html?artnum=305759 docs.info.apple.com
- http://docs.info.apple.com/article.html?artnum=306173 docs.info.apple.com
- http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html Patch
- http://osvdb.org/36449 osvdb.org
- http://secunia.com/advisories/25786 Patch, Vendor Advisory
- http://secunia.com/advisories/26287 Vendor Advisory
- http://www.kb.cert.org/vuls/id/845708 US Government Resource
- http://www.securityfocus.com/archive/1/472198/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/24598 Patch
- http://www.securitytracker.com/id?1018281 Patch
- http://www.vupen.com/english/advisories/2007/2296 www.vupen.com
- http://www.vupen.com/english/advisories/2007/2316 www.vupen.com
- http://www.vupen.com/english/advisories/2007/2731 www.vupen.com
- http://www.westpoint.ltd.uk/advisories/wp-07-0002.txt Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35017 exchange.xforce.ibmcloud.com
- http://docs.info.apple.com/article.html?artnum=305759 docs.info.apple.com
- http://docs.info.apple.com/article.html?artnum=306173 docs.info.apple.com
- http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html Patch
- http://osvdb.org/36449 osvdb.org
- http://secunia.com/advisories/25786 Patch, Vendor Advisory
- http://secunia.com/advisories/26287 Vendor Advisory
- http://www.kb.cert.org/vuls/id/845708 US Government Resource
- http://www.securityfocus.com/archive/1/472198/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/24598 Patch
- http://www.securitytracker.com/id?1018281 Patch
- http://www.vupen.com/english/advisories/2007/2296 www.vupen.com
- http://www.vupen.com/english/advisories/2007/2316 www.vupen.com
- http://www.vupen.com/english/advisories/2007/2731 www.vupen.com
- http://www.westpoint.ltd.uk/advisories/wp-07-0002.txt Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35017 exchange.xforce.ibmcloud.com