CVEvulnerability
CVE-2015-3752
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-08-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.
Affected configurations
• apple safari (>= 6.0 < 6.2.8)
• apple safari (>= 7.0 < 7.1.8)
• apple safari (>= 8.0 < 8.0.8)
• apple iphone os (< 8.4.1)
• canonical ubuntu linux 14.04
• canonical ubuntu linux 15.10
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html Mailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Mailing List, Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/76341 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033274 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2937-1 Third Party Advisory
- https://support.apple.com/kb/HT205030 Vendor Advisory
- https://support.apple.com/kb/HT205033 Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html Mailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Mailing List, Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/76341 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033274 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2937-1 Third Party Advisory
- https://support.apple.com/kb/HT205030 Vendor Advisory
- https://support.apple.com/kb/HT205033 Vendor Advisory