fkie_cve-2009-1714
Vulnerability from fkie_nvd
Published
2009-06-10 18:00
Modified
2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes.
References
cve@mitre.orghttp://lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlPatch, Vendor Advisory
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
cve@mitre.orghttp://osvdb.org/55023
cve@mitre.orghttp://secunia.com/advisories/35379Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/37746
cve@mitre.orghttp://secunia.com/advisories/43068
cve@mitre.orghttp://securitytracker.com/id?1022344
cve@mitre.orghttp://support.apple.com/kb/HT3613Patch, Vendor Advisory
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1950
cve@mitre.orghttp://www.securityfocus.com/bid/35260Exploit, Patch
cve@mitre.orghttp://www.securityfocus.com/bid/35348
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1522Patch, Vendor Advisory
cve@mitre.orghttp://www.vupen.com/english/advisories/2011/0212
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/51268
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/55023
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35379Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37746
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43068
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1022344
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT3613Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1950
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/35260Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/35348
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1522Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0212
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/51268
Impacted products
Vendor Product Version
apple safari *
apple safari 0.8
apple safari 0.9
apple safari 1.0
apple safari 1.0.3
apple safari 1.1
apple safari 1.2
apple safari 1.3
apple safari 1.3.1
apple safari 1.3.2
apple safari 2.0
apple safari 2.0.2
apple safari 2.0.4
apple safari 3.0
apple safari 3.0.2
apple safari 3.0.3
apple safari 3.0.4
apple safari 3.1
apple safari 3.1.1
apple safari 3.1.2
apple safari 3.2.1
apple safari 3.2.3
apple safari *
apple safari 3.0
apple safari 3.0.1
apple safari 3.0.2
apple safari 3.0.3
apple safari 3.0.4
apple safari 3.1
apple safari 3.1.1
apple safari 3.1.2
apple safari 3.2
apple safari 3.2.1
apple safari 3.2.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:-:mac:*:*:*:*:*",
              "matchCriteriaId": "D72FE38B-BD04-4FC7-AE41-6459CBDF207A",
              "versionEndIncluding": "4.0_beta",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:0.8:-:mac:*:*:*:*:*",
              "matchCriteriaId": "7F7275FE-C28A-4067-B9EF-BC99E10188DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:0.9:-:mac:*:*:*:*:*",
              "matchCriteriaId": "E2249206-EF91-4168-B7C2-C1DB35CDFA40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.0:-:mac:*:*:*:*:*",
              "matchCriteriaId": "641D655F-E210-4795-836C-BBF6D90B92E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.0.3:-:mac:*:*:*:*:*",
              "matchCriteriaId": "A6EED222-BF5E-475A-B255-18041B4A5B26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "1FC456E7-727C-4932-A0D0-B0D168E8C523",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "303E4616-1BB6-4D2D-8437-47F3D1B3C13D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.3:-:mac:*:*:*:*:*",
              "matchCriteriaId": "03C2A522-2D71-4909-B86F-DBEE2C703F83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.3.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "E75B3EAD-A9D3-4497-B3B0-E31E807010A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.3.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "F837BE0E-9255-41C5-8E49-57090A574A9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:2.0:-:mac:*:*:*:*:*",
              "matchCriteriaId": "B8870C90-A1C9-4D8C-B1EF-9D72D55535EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:2.0.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "586ED537-9BB4-4931-8891-E60740983C4A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:2.0.4:-:mac:*:*:*:*:*",
              "matchCriteriaId": "73B23547-9710-44E9-A32A-6320C8E7A780",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0:-:mac:*:*:*:*:*",
              "matchCriteriaId": "EBFEED2C-8822-44EB-9296-82862DB14DCE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "9270F5C4-63B9-48C5-9D6D-9CDA1461205C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.3:-:mac:*:*:*:*:*",
              "matchCriteriaId": "FD35EC3D-01E2-4FA7-95AC-A2E57C652649",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.4:-:mac:*:*:*:*:*",
              "matchCriteriaId": "C23C022E-293E-4247-A9AD-2F27C29E92A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "75359A0E-823A-45C5-8C61-ABE225FB939F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "8CFED254-6277-4E5E-B8E7-B5CB1ED3E7FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "F8283078-D722-40AC-AF7A-7BC9AD19D051",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "66132AA6-F3EA-408D-9C43-8E6C577C8F72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2.3:-:mac:*:*:*:*:*",
              "matchCriteriaId": "D8CFE8E7-B970-4B86-99E9-AC3F8626737C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:-:windows:*:*:*:*:*",
              "matchCriteriaId": "7E203D81-FABE-4A63-8930-1DA15A86E113",
              "versionEndIncluding": "3.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0:-:windows:*:*:*:*:*",
              "matchCriteriaId": "49875E29-AA30-4D96-9ED9-538823DD5E1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.1:-:windows:*:*:*:*:*",
              "matchCriteriaId": "D6C733F3-F5D4-4CF1-866D-61FF9D81D1B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.2:-:windows:*:*:*:*:*",
              "matchCriteriaId": "C5471735-D9C0-491B-9A6A-07B39AA215CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.3:-:windows:*:*:*:*:*",
              "matchCriteriaId": "1E5C52F3-2109-40FD-9945-A9A9D42C076E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.4:-:windows:*:*:*:*:*",
              "matchCriteriaId": "151DEB6D-5857-4B0B-8449-5735768024A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1:-:windows:*:*:*:*:*",
              "matchCriteriaId": "AC7E7F65-8F3B-42F8-8B2D-9EA1CC4A4300",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1.1:-:windows:*:*:*:*:*",
              "matchCriteriaId": "476EBE1F-66E1-4EF5-8344-BEDA97F306A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1.2:-:windows:*:*:*:*:*",
              "matchCriteriaId": "480ED2AC-0DA4-44DA-A902-8534335077B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*",
              "matchCriteriaId": "77F31F4B-5305-4D75-9277-95EF99A969A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2.1:-:windows:*:*:*:*:*",
              "matchCriteriaId": "C9AD216D-0C95-4843-A1A1-C3C9A6219277",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2.2:-:windows:*:*:*:*:*",
              "matchCriteriaId": "04B8652D-BE06-49CB-A636-8B53B2DF9168",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados en Web Inspector en WebKit in Apple Safari anterior a v4.0, permite a atacantes asistidos por el usuario, inyectar secuencias comandos web o HTML de su elecci\u00f3n y leer archivos locales, a trav\u00e9s de vectores relacionado con caracteres de escape HTML inapropiados."
    }
  ],
  "id": "CVE-2009-1714",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-06-10T18:00:00.843",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/55023"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35379"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/37746"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/43068"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1022344"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT3613"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1950"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/35260"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/35348"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1522"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2011/0212"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51268"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/55023"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35379"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/37746"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/43068"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1022344"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT3613"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1950"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/35260"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/35348"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1522"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2011/0212"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51268"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.