CVE-2016-4651 — Cross-site Scripting in Apple Iphone OS

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 61.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple Iphone OSApple SafariApple IOS
Timeline
PublishedJul 22
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶NVDapple/safari9.1.1
▶Appleapple/safari9.1.2
▶NVDapple/iphone_os9.3.2
▶Appleapple/ios9.3.3

🔴Vulnerability Details

2
GHSA
GHSA-377q-pqm6-wg2h: Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9↗2022-05-14
▶
OSV
CVE-2016-4651: Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9↗2016-07-21
▶

📋Vendor Advisories

3
Ubuntu
WebKitGTK+ vulnerabilities↗2016-09-14
▶
Apple
CVE-2016-4651: iOS 9.3.3↗2016-07-18
▶
Apple
CVE-2016-4651: Safari 9.1.2↗2016-07-18
▶
CVE-2016-4651 — Cross-site Scripting in Apple Iphone OS | cvebase