Lucene search

[email protected]CVE-2009-2066

HistoryJun 15, 2009 - 7:30 p.m.

CVE-2009-2066

2009-06-1519:30:05

CWE-287

[email protected]

web.nvd.nist.gov

apple

safari

vulnerability

cve-2009-2066

man-in-the-middle

http

https

web script

security

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

54.7%

JSON

Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site’s context, by modifying an http page to include an https iframe that references a script file on an http site, related to “HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages.”

Affected configurations

NVD

Node

applesafariRange≤3.2.1

applesafariMatch0.8

applesafariMatch0.9

applesafariMatch1.0

applesafariMatch1.0beta

applesafariMatch1.0beta2

applesafariMatch1.0.0

applesafariMatch1.0.0b1

applesafariMatch1.0.0b2

applesafariMatch1.0.1

applesafariMatch1.0.2

applesafariMatch1.0.3

applesafariMatch1.0.385.8

applesafariMatch1.0.385.8.1

applesafariMatch1.1

applesafariMatch1.1.0

applesafariMatch1.1.1

applesafariMatch1.2

applesafariMatch1.2.0

applesafariMatch1.2.1

applesafariMatch1.2.2

applesafariMatch1.2.3

applesafariMatch1.2.4

applesafariMatch1.2.5

applesafariMatch1.3

applesafariMatch1.3.0

applesafariMatch1.3.1

applesafariMatch1.3.2

applesafariMatch1.3.2312.5

applesafariMatch1.3.2312.6

applesafariMatch2

applesafariMatch2.0

applesafariMatch2.0.0

applesafariMatch2.0.1

applesafariMatch2.0.2

applesafariMatch2.0.3

applesafariMatch2.0.3417.8

applesafariMatch2.0.3417.9

applesafariMatch2.0.3417.9.2

applesafariMatch2.0.3417.9.3

applesafariMatch2.0.3_417.9.3

applesafariMatch2.0.4

applesafariMatch2.0.4_419.3

applesafariMatch2.0_pre

applesafariMatch3

applesafariMatch3.0

applesafariMatch3.0.0

applesafariMatch3.0.0b

applesafariMatch3.0.1

applesafariMatch3.0.1beta

applesafariMatch3.0.1b

applesafariMatch3.0.2

applesafariMatch3.0.2b

applesafariMatch3.0.3

applesafariMatch3.0.3522.15.5

applesafariMatch3.0.3b

applesafariMatch3.0.4

applesafariMatch3.0.4_beta

applesafariMatch3.0.4b

applesafariMatch3.1

applesafariMatch3.1.0

applesafariMatch3.1.0b

applesafariMatch3.1.1

applesafariMatch3.1.2

applesafariMatch3.2

applesafariMatch3.2.0

CPENameOperatorVersion
apple:safariapple safarile3.2.1
apple:safariapple safarieq0.8
apple:safariapple safarieq0.9
apple:safariapple safarieq1.0
apple:safariapple safarieq1.0.0
apple:safariapple safarieq1.0.0b1
apple:safariapple safarieq1.0.0b2
apple:safariapple safarieq1.0.1
apple:safariapple safarieq1.0.2
apple:safariapple safarieq1.0.3

CPE	Name	Operator	Version
apple:safari	apple safari	le	3.2.1
apple:safari	apple safari	eq	0.8
apple:safari	apple safari	eq	0.9
apple:safari	apple safari	eq	1.0
apple:safari	apple safari	eq	1.0.0
apple:safari	apple safari	eq	1.0.0b1
apple:safari	apple safari	eq	1.0.0b2
apple:safari	apple safari	eq	1.0.1
apple:safari	apple safari	eq	1.0.2
apple:safari	apple safari	eq	1.0.3