CVE-2015-5780 — Improper Input Validation in Apple Safari

CWE-20 — Improper Input Validation3 documents3 sources
Severity
10.0CRITICALNVD
EPSS
0.6%
top 29.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple SafariApple Safari 9
Timeline
PublishedOct 9
Latest updateMay 17

Description

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages2 packages

▶NVDapple/safari8.0.8

🔴Vulnerability Details

1
GHSA
GHSA-5x49-686j-4rp5: The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has un↗2022-05-17
▶

📋Vendor Advisories

1
Apple
CVE-2015-5780: Safari 9↗
▶