CVE-2009-1681
published 2009-06-10CVE-2009-1681: WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
3.02%
86.1th percentile
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | safari | <= 4.0_beta | — |
| apple | safari | <= 3.2.3 | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j47h-fp92-hhrq: WebKit in Apple Safari before 4
ghsa_unreviewed·2022-05-02
CVE-2009-1681 [MEDIUM] GHSA-j47h-fp92-hhrq: WebKit in Apple Safari before 4
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document.
OSV
CVE-2009-1681: WebKit in Apple Safari before 4
osv·2009-06-10·CVSS 4.3
CVE-2009-1681 [MEDIUM] CVE-2009-1681: WebKit in Apple Safari before 4
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlhttp://lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlhttp://osvdb.org/54981http://secunia.com/advisories/35379http://secunia.com/advisories/37746http://secunia.com/advisories/43068http://support.apple.com/kb/HT3613http://support.apple.com/kb/HT3639http://www.debian.org/security/2009/dsa-1950http://www.securityfocus.com/bid/35260http://www.securityfocus.com/bid/35317http://www.vupen.com/english/advisories/2009/1522http://www.vupen.com/english/advisories/2009/1621http://www.vupen.com/english/advisories/2011/0212http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlhttp://lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlhttp://osvdb.org/54981http://secunia.com/advisories/35379http://secunia.com/advisories/37746http://secunia.com/advisories/43068http://support.apple.com/kb/HT3613http://support.apple.com/kb/HT3639http://www.debian.org/security/2009/dsa-1950http://www.securityfocus.com/bid/35260http://www.securityfocus.com/bid/35317http://www.vupen.com/english/advisories/2009/1522http://www.vupen.com/english/advisories/2009/1621http://www.vupen.com/english/advisories/2011/0212
2009-06-10
Published