CVE-2009-2816
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
La implementación de Cross-Origin Resource Sharing (CORS) en WebKit, tal como es usado en Safari de Apple anterior a versión 4.0.4 y Chrome de Google anterior a versión 3.0.195.33, incluye ciertos encabezados HTTP personalizados en la petición OPTIONS durante operaciones entre orígenes con comprobación previa, lo que facilita a los atacantes remotos conducir ataques de tipo cross-site request forgery (CSRF) por medio de una página web especialmente diseñada.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-08-17 CVE Reserved
- 2009-11-13 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (22)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/59940 | Broken Link | |
| http://osvdb.org/59967 | Broken Link | |
| http://secunia.com/advisories/37346 | Third Party Advisory | |
| http://secunia.com/advisories/37358 | Third Party Advisory | |
| http://secunia.com/advisories/37393 | Third Party Advisory | |
| http://secunia.com/advisories/37397 | Third Party Advisory | |
| http://secunia.com/advisories/43068 | Third Party Advisory | |
| http://www.securityfocus.com/bid/36997 | Third Party Advisory | |
| http://www.securitytracker.com/id?1023165 | Third Party Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=525789 | Issue Tracking | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/54239 | Third Party Advisory | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6516 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html | 2021-11-08 | |
| http://support.apple.com/kb/HT3949 | 2021-11-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | < 4.0.4 Search vendor "Apple" for product "Safari" and version " < 4.0.4" | - |
Affected
| ||||||
| Google Search vendor "Google" | Chrome Search vendor "Google" for product "Chrome" | < 3.0.195.33 Search vendor "Google" for product "Chrome" and version " < 3.0.195.33" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | < 4.0 Search vendor "Apple" for product "Iphone Os" and version " < 4.0" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 11.2 Search vendor "Opensuse" for product "Opensuse" and version "11.2" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 11.3 Search vendor "Opensuse" for product "Opensuse" and version "11.3" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 11 Search vendor "Fedoraproject" for product "Fedora" and version "11" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 12 Search vendor "Fedoraproject" for product "Fedora" and version "12" | - |
Affected
| ||||||