CVEvulnerability
CVE-2009-2797
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-09-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
Affected configurations
• apple iphone os (< 3.1)
• apple iphone os (< 3.1.1)
• canonical ubuntu linux 9.10
• canonical ubuntu linux 10.04
• canonical ubuntu linux 10.10
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html Mailing List, Patch, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html Third Party Advisory
- http://secunia.com/advisories/36677 Third Party Advisory
- http://secunia.com/advisories/41856 Third Party Advisory
- http://secunia.com/advisories/43068 Third Party Advisory
- http://support.apple.com/kb/HT3860 Patch, Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 Third Party Advisory
- http://www.securityfocus.com/bid/36339 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1006-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2010/2722 Third Party Advisory
- http://www.vupen.com/english/advisories/2011/0212 Third Party Advisory
- http://www.vupen.com/english/advisories/2011/0552 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53187 Third Party Advisory, VDB Entry
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html Mailing List, Patch, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html Third Party Advisory
- http://secunia.com/advisories/36677 Third Party Advisory
- http://secunia.com/advisories/41856 Third Party Advisory
- http://secunia.com/advisories/43068 Third Party Advisory
- http://support.apple.com/kb/HT3860 Patch, Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 Third Party Advisory
- http://www.securityfocus.com/bid/36339 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1006-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2010/2722 Third Party Advisory
- http://www.vupen.com/english/advisories/2011/0212 Third Party Advisory
- http://www.vupen.com/english/advisories/2011/0552 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53187 Third Party Advisory, VDB Entry