CVE-2009-2797
published 2009-09-10CVE-2009-2797: The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent…
PriorityP426medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
3.58%
88.2th percentile
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | iphone_os | < 3.1 | 3.1 |
| apple | iphone_os | < 3.1.1 | 3.1.1 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j22q-m838-5xhc: The WebKit component in Safari in Apple iPhone OS before 3
ghsa_unreviewed·2022-05-02
CVE-2009-2797 [MEDIUM] CWE-200 GHSA-j22q-m838-5xhc: The WebKit component in Safari in Apple iPhone OS before 3
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
OSV
CVE-2009-2797: The WebKit component in Safari in Apple iPhone OS before 3
osv·2009-09-10·CVSS 5.0
CVE-2009-2797 [MEDIUM] CVE-2009-2797: The WebKit component in Safari in Apple iPhone OS before 3
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
Red Hat
qt: User credentials disclosure via URLs sent in Referer headers
vendor_redhat·2009-04-14·CVSS 5.0
CVE-2009-2797 [MEDIUM] qt: User credentials disclosure via URLs sent in Referer headers
qt: User credentials disclosure via URLs sent in Referer headers
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
No detection rules found.
No public exploits indexed.
http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlhttp://secunia.com/advisories/36677http://secunia.com/advisories/41856http://secunia.com/advisories/43068http://support.apple.com/kb/HT3860http://www.mandriva.com/security/advisories?name=MDVSA-2011:039http://www.securityfocus.com/bid/36339http://www.ubuntu.com/usn/USN-1006-1http://www.vupen.com/english/advisories/2010/2722http://www.vupen.com/english/advisories/2011/0212http://www.vupen.com/english/advisories/2011/0552https://exchange.xforce.ibmcloud.com/vulnerabilities/53187http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlhttp://secunia.com/advisories/36677http://secunia.com/advisories/41856http://secunia.com/advisories/43068http://support.apple.com/kb/HT3860http://www.mandriva.com/security/advisories?name=MDVSA-2011:039http://www.securityfocus.com/bid/36339http://www.ubuntu.com/usn/USN-1006-1http://www.vupen.com/english/advisories/2010/2722http://www.vupen.com/english/advisories/2011/0212http://www.vupen.com/english/advisories/2011/0552https://exchange.xforce.ibmcloud.com/vulnerabilities/53187
2009-09-10
Published