CVE-2009-2816

Published Nov 13, 2009

Last updated 3 years ago

Overview

Description: The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-352

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "77BC4840-8A34-40F9-873B-DF0F4CADCBDD",
            "versionEndExcluding": "4.0.4"
          },
          {
            "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "56C129DC-11E1-4710-B0F1-E0AF5AF6F6F7",
            "versionEndExcluding": "3.0.195.33"
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "73DE6E60-6BDD-450C-B7E2-744A0183A2DD",
            "versionEndExcluding": "4.0"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A01C8B7E-EB19-40EA-B1D2-9AE5EA536C95"
          },
          {
            "criteria": "cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5646FDE9-CF21-46A9-B89D-F5BBDB4249AF"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B3BB5EDB-520B-4DEF-B06E-65CA13152824"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E44669D7-6C1E-4844-B78A-73E253A7CC17"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References