CVE-2015-3752

2015-08-1623:59:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2015-3752

content security policy

webkit

apple safari

cookie transmission restriction

vulnerability

nvd

ios

cross-origin request

private-browsing request

6.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

72.2%

JSON

The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.

CPENameOperatorVersion
apple:safariapple safarilt6.2.8
apple:safariapple safarilt7.1.8
apple:safariapple safarilt8.0.8
apple:iphone_osapple iphone oslt8.4.1
canonical:ubuntu_linuxcanonical ubuntu linuxeq15.10
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.04

CPE	Name	Operator	Version
apple:safari	apple safari	lt	6.2.8
apple:safari	apple safari	lt	7.1.8
apple:safari	apple safari	lt	8.0.8
apple:iphone_os	apple iphone os	lt	8.4.1
canonical:ubuntu_linux	canonical ubuntu linux	eq	15.10
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.04