Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-3752

The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.

Published

2015-08-16T23:59:25.533

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apple	safari	< 6.2.8	Yes
Application	apple	safari	< 7.1.8	Yes
Application	apple	safari	< 8.0.8	Yes
Operating System	apple	iphone_os	< 8.4.1	Yes
Operating System	canonical	ubuntu_linux	14.04	Yes
Operating System	canonical	ubuntu_linux	15.10	Yes

References

http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html Mailing List, Vendor Advisory ([email protected])
http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Mailing List, Vendor Advisory ([email protected])
http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html Mailing List, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/76341 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1033274 Third Party Advisory, VDB Entry ([email protected])
http://www.ubuntu.com/usn/USN-2937-1 Third Party Advisory ([email protected])
https://support.apple.com/kb/HT205030 Vendor Advisory ([email protected])
https://support.apple.com/kb/HT205033 Vendor Advisory ([email protected])
http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html Mailing List, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Mailing List, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/76341 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1033274 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-2937-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT205030 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT205033 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)