CVE-2012-0647

WebKit in Apple Safari before 5.1.4 does not properly handle redirects in conjunction with HTTP authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header.

Score

CVSS 2.0 5.0 Medium

Status

Modified - product-security@apple.com

Published

2012-03-12

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Safari (Apple)

References

• http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
• http://secunia.com/advisories/48377
• http://www.securitytracker.com/id?1026785