CVE-2009-2062 — Improper Authentication in Apple Safari

CWE-287 — Improper Authentication5 documents3 sources
Severity
6.8MEDIUMNVD
NVD4.3
EPSS
0.3%
top 46.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple SafariApple MAC OS XApple MAC OS X Server
Timeline
PublishedJun 15
Latest updateMay 2

Description

Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶NVDapple/safari3.2.1+53
▶NVDapple/mac_os_x9 versions+8
▶NVDapple/mac_os_x_server9 versions+8

🔴Vulnerability Details

2
GHSA
GHSA-wp4r-4843-vx39: Apple Safari before 3↗2022-05-02
▶
GHSA
GHSA-j4q2-v3p9-r94x: CFNetwork in Apple Mac OS X 10↗2022-05-02
▶

💥Exploits & PoCs

1
Exploit-DB
ActiveBuyandSell 6.2 - 'buyersend.asp?catid' Blind SQL Injection↗2009-12-17
▶