CVE-2015-3752

The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.

Score
CVSS 2.0 5.0 Medium
Status
Modified - product-security@apple.com
Published
2015-08-16
Last modified
2024-08-06
Weaknesses
CWE-200

Affected products

References

 
 
© AVABIS GmbH privacypolicy about