CVE-2015-5826 — Improper Access Control in Apple Iphone OS

CWE-284 — Improper Access Control5 documents4 sources

Severity

4.3MEDIUMNVD

EPSS

0.7%

top 28.78%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apple Iphone OS Apple Safari Apple IOS 9 +1 more

Timeline

PublishedSep 18

Latest updateMay 17

Description

WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶NVDapple/safari8.0.8

▶NVDapple/iphone_os8.4.1

▶Appleapple/ios_9

▶Appleapple/safari_9

🔴Vulnerability Details

GHSA

GHSA-7rq3-2jrc-rch2: WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css cont↗2022-05-17

▶

OSV

CVE-2015-5826: WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css cont↗2015-09-18

▶

📋Vendor Advisories

Apple

CVE-2015-5826: Safari 9↗

▶

Apple

CVE-2015-5826: iOS 9↗

▶