Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2015-1126 — Improper Input Validation in Apple Iphone OS

CWE-20 — Improper Input Validation7 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
65.4%
top 1.50%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Apple Iphone OSApple SafariApple IOS+1 more
Timeline
PublishedApr 10
Latest updateMay 17

Description

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶NVDapple/safari6.2.4+17
▶Appleapple/ios8.3

🔴Vulnerability Details

2
GHSA
GHSA-r4c3-86wx-hvpp: WebKit, as used in Apple iOS before 8↗2022-05-17
▶
OSV
CVE-2015-1126: WebKit, as used in Apple iOS before 8↗2015-04-10
▶

💥Exploits & PoCs

2
Exploit-DB
Foxit Reader 7.0.6.1126 - Unquoted Service Path Privilege Escalation↗2015-03-16
▶
Metasploit
Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft↗
▶

📋Vendor Advisories

2
Apple
CVE-2015-1126: iOS 8.3↗
▶
Apple
CVE-2015-1126: Safari 8.0.5, Safari 7.1.5, and Safari 6.2.5↗
▶