CVE-2015-3750 — Apple Iphone OS vulnerability

CWE-2546 documents4 sources
Severity
6.4MEDIUMNVD
EPSS
0.8%
top 26.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple Iphone OSApple SafariApple TV+2 more
Timeline
PublishedAug 16
Latest updateMay 14

Description

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages5 packages

▶NVDapple/safari6.0 — 6.2.8+2
▶NVDapple/iphone_os< 8.4.1+1
▶Appleapple/ios8.4.1
▶Appleapple/apple_tv7.2.1

🔴Vulnerability Details

2
GHSA
GHSA-544q-w4rg-fjc5: WebKit in Apple Safari before 6↗2022-05-14
▶
OSV
CVE-2015-3750: WebKit in Apple Safari before 6↗2015-08-16
▶

📋Vendor Advisories

3
Apple
CVE-2015-3750: Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8↗
▶
Apple
CVE-2015-3750: iOS 8.4.1↗
▶
Apple
CVE-2015-3750: Apple TV 7.2.1↗
▶
CVE-2015-3750 — Apple Iphone OS vulnerability | cvebase