| Vulnerability Name: | CVE-2015-1126 (CCN-102123) | ||||||||||||||||||||
| Assigned: | 2015-04-08 | ||||||||||||||||||||
| Published: | 2015-04-08 | ||||||||||||||||||||
| Updated: | 2015-09-11 | ||||||||||||||||||||
| Summary: | WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors. | ||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N) 3.6 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:F/RL:OF/RC:C)
3.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:F/RL:OF/RC:C)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-20 | ||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2015-1126 Source: APPLE Type: Vendor Advisory APPLE-SA-2015-04-08-1 Source: APPLE Type: Vendor Advisory APPLE-SA-2015-04-08-3 Source: SECTRACK Type: UNKNOWN 1032047 Source: XF Type: UNKNOWN apple-safari-cve20151126-sec-bypass(102123) Source: CCN Type: Packet Storm Security [04-12-2015] Safari Cross-Domain Hijacking Source: CCN Type: Apple Web site About the security content of Safari 8.0.5, Safari 7.1.5, and Safari 6.2.5 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT204658 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT204661 | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||