Vulnerability Details : CVE-2009-1691
Potential exploit
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to insufficient access control for standard JavaScript prototypes in other domains.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2009-1691
- cpe:2.3:a:apple:safari:*:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:*:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.2.2:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.2:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1.2:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:0.8:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:1.3.2:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.3:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.4:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:1.1:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:1.2:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.2.1:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.2.3:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:1.0:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:1.0.3:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.2:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.4:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1.1:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:1.3:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:1.3.1:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:0.9:-:mac:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.2:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1.2:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.3:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.4:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.1:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.2.1:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1:-:windows:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1.1:-:windows:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-1691
0.61%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 69 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-1691
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2009-1691
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-1691
-
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
Patch;Vendor Advisory
-
http://support.apple.com/kb/HT3613
About the security content of Safari 4.0 - Apple SupportPatch;Vendor Advisory
-
http://secunia.com/advisories/43068
Sign in
-
http://osvdb.org/54989
-
http://www.securityfocus.com/bid/35330
-
http://www.vupen.com/english/advisories/2011/0212
Webmail | OVH- OVH
-
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
-
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2011:002
-
http://secunia.com/advisories/35379
About Secunia Research | FlexeraVendor Advisory
-
http://www.vupen.com/english/advisories/2009/1522
Webmail: access your OVH emails on ovhcloud.com | OVHcloudPatch;Vendor Advisory
-
http://securitytracker.com/id?1022344
Access Denied
-
http://www.vupen.com/english/advisories/2009/1621
Webmail: access your OVH emails on ovhcloud.com | OVHcloud
-
http://www.securityfocus.com/bid/35260
Exploit;Patch
-
http://support.apple.com/kb/HT3639
About the security content of iOS 3.0 Software Update - Apple Support
Jump to