CVEvulnerability
CVE-2015-3750
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-08-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-254
Description
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
Affected configurations
• apple iphone os (<= 8.4)
• apple safari (>= 6.0 < 6.2.8)
• apple safari (>= 7.0 < 7.1.8)
• apple safari (>= 8.0 < 8.0.8)
• apple iphone os (< 8.4.1)
Related
Weakness · not in database (1)
References
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html Mailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Mailing List, Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/76341 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033274 Third Party Advisory, VDB Entry
- https://support.apple.com/kb/HT205030 Vendor Advisory
- https://support.apple.com/kb/HT205033 Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html Mailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Mailing List, Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/76341 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033274 Third Party Advisory, VDB Entry
- https://support.apple.com/kb/HT205030 Vendor Advisory
- https://support.apple.com/kb/HT205033 Vendor Advisory