Lucene search

[email protected]CVE-2009-1681

HistoryJun 10, 2009 - 2:30 p.m.

CVE-2009-1681

2009-06-1014:30:00

[email protected]

web.nvd.nist.gov

cve

2009

1681

webkit

apple

safari

iphone os

ipod touch

clickjacking

same origin policy

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.8 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

77.7%

JSON

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct “clickjacking” attacks via a crafted HTML document.

Affected configurations

NVD

Node

applesafariRange≤4.0_betamac

applesafariMatch0.8mac

applesafariMatch0.9mac

applesafariMatch1.0mac

applesafariMatch1.0.3mac

applesafariMatch1.1mac

applesafariMatch1.2mac

applesafariMatch1.3mac

applesafariMatch1.3.1mac

applesafariMatch1.3.2mac

applesafariMatch2.0mac

applesafariMatch2.0.2mac

applesafariMatch2.0.4mac

applesafariMatch3.0mac

applesafariMatch3.0.2-mac

applesafariMatch3.0.3mac

applesafariMatch3.0.4mac

applesafariMatch3.1mac

applesafariMatch3.1.1mac

applesafariMatch3.1.2mac

applesafariMatch3.2.1mac

applesafariMatch3.2.3mac

Node

applesafariRange≤3.2.3windows

applesafariMatch3.0windows

applesafariMatch3.0.1windows

applesafariMatch3.0.2windows

applesafariMatch3.0.3windows

applesafariMatch3.0.4windows

applesafariMatch3.1windows

applesafariMatch3.1.1windows

applesafariMatch3.1.2windows

applesafariMatch3.2-windows

applesafariMatch3.2.1windows

applesafariMatch3.2.2windows

CPENameOperatorVersion
apple:safariapple safarile4.0_beta
apple:safariapple safarieq0.8
apple:safariapple safarieq0.9
apple:safariapple safarieq1.0
apple:safariapple safarieq1.0.3
apple:safariapple safarieq1.1
apple:safariapple safarieq1.2
apple:safariapple safarieq1.3
apple:safariapple safarieq1.3.1
apple:safariapple safarieq1.3.2

CPE	Name	Operator	Version
apple:safari	apple safari	le	4.0_beta
apple:safari	apple safari	eq	0.8
apple:safari	apple safari	eq	0.9
apple:safari	apple safari	eq	1.0
apple:safari	apple safari	eq	1.0.3
apple:safari	apple safari	eq	1.1
apple:safari	apple safari	eq	1.2
apple:safari	apple safari	eq	1.3
apple:safari	apple safari	eq	1.3.1
apple:safari	apple safari	eq	1.3.2