FKIE_CVE-2009-1714

Vulnerability from fkie_nvd - Published: 2009-06-10 18:00 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes.
References
cve@mitre.orghttp://lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlPatch, Vendor Advisory
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
cve@mitre.orghttp://osvdb.org/55023
cve@mitre.orghttp://secunia.com/advisories/35379Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/37746
cve@mitre.orghttp://secunia.com/advisories/43068
cve@mitre.orghttp://securitytracker.com/id?1022344
cve@mitre.orghttp://support.apple.com/kb/HT3613Patch, Vendor Advisory
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1950
cve@mitre.orghttp://www.securityfocus.com/bid/35260Exploit, Patch
cve@mitre.orghttp://www.securityfocus.com/bid/35348
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1522Patch, Vendor Advisory
cve@mitre.orghttp://www.vupen.com/english/advisories/2011/0212
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/51268
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/55023
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35379Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37746
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43068
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1022344
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT3613Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1950
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/35260Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/35348
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1522Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0212
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/51268
Impacted products
Vendor Product Version
apple safari *
apple safari 0.8
apple safari 0.9
apple safari 1.0
apple safari 1.0.3
apple safari 1.1
apple safari 1.2
apple safari 1.3
apple safari 1.3.1
apple safari 1.3.2
apple safari 2.0
apple safari 2.0.2
apple safari 2.0.4
apple safari 3.0
apple safari 3.0.2
apple safari 3.0.3
apple safari 3.0.4
apple safari 3.1
apple safari 3.1.1
apple safari 3.1.2
apple safari 3.2.1
apple safari 3.2.3
apple safari *
apple safari 3.0
apple safari 3.0.1
apple safari 3.0.2
apple safari 3.0.3
apple safari 3.0.4
apple safari 3.1
apple safari 3.1.1
apple safari 3.1.2
apple safari 3.2
apple safari 3.2.1
apple safari 3.2.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:-:mac:*:*:*:*:*",
              "matchCriteriaId": "D72FE38B-BD04-4FC7-AE41-6459CBDF207A",
              "versionEndIncluding": "4.0_beta",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:0.8:-:mac:*:*:*:*:*",
              "matchCriteriaId": "7F7275FE-C28A-4067-B9EF-BC99E10188DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:0.9:-:mac:*:*:*:*:*",
              "matchCriteriaId": "E2249206-EF91-4168-B7C2-C1DB35CDFA40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.0:-:mac:*:*:*:*:*",
              "matchCriteriaId": "641D655F-E210-4795-836C-BBF6D90B92E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.0.3:-:mac:*:*:*:*:*",
              "matchCriteriaId": "A6EED222-BF5E-475A-B255-18041B4A5B26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "1FC456E7-727C-4932-A0D0-B0D168E8C523",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "303E4616-1BB6-4D2D-8437-47F3D1B3C13D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.3:-:mac:*:*:*:*:*",
              "matchCriteriaId": "03C2A522-2D71-4909-B86F-DBEE2C703F83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.3.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "E75B3EAD-A9D3-4497-B3B0-E31E807010A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.3.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "F837BE0E-9255-41C5-8E49-57090A574A9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:2.0:-:mac:*:*:*:*:*",
              "matchCriteriaId": "B8870C90-A1C9-4D8C-B1EF-9D72D55535EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:2.0.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "586ED537-9BB4-4931-8891-E60740983C4A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:2.0.4:-:mac:*:*:*:*:*",
              "matchCriteriaId": "73B23547-9710-44E9-A32A-6320C8E7A780",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0:-:mac:*:*:*:*:*",
              "matchCriteriaId": "EBFEED2C-8822-44EB-9296-82862DB14DCE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "9270F5C4-63B9-48C5-9D6D-9CDA1461205C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.3:-:mac:*:*:*:*:*",
              "matchCriteriaId": "FD35EC3D-01E2-4FA7-95AC-A2E57C652649",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.4:-:mac:*:*:*:*:*",
              "matchCriteriaId": "C23C022E-293E-4247-A9AD-2F27C29E92A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "75359A0E-823A-45C5-8C61-ABE225FB939F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "8CFED254-6277-4E5E-B8E7-B5CB1ED3E7FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1.2:-:mac:*:*:*:*:*",
              "matchCriteriaId": "F8283078-D722-40AC-AF7A-7BC9AD19D051",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2.1:-:mac:*:*:*:*:*",
              "matchCriteriaId": "66132AA6-F3EA-408D-9C43-8E6C577C8F72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2.3:-:mac:*:*:*:*:*",
              "matchCriteriaId": "D8CFE8E7-B970-4B86-99E9-AC3F8626737C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:-:windows:*:*:*:*:*",
              "matchCriteriaId": "7E203D81-FABE-4A63-8930-1DA15A86E113",
              "versionEndIncluding": "3.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0:-:windows:*:*:*:*:*",
              "matchCriteriaId": "49875E29-AA30-4D96-9ED9-538823DD5E1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.1:-:windows:*:*:*:*:*",
              "matchCriteriaId": "D6C733F3-F5D4-4CF1-866D-61FF9D81D1B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.2:-:windows:*:*:*:*:*",
              "matchCriteriaId": "C5471735-D9C0-491B-9A6A-07B39AA215CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.3:-:windows:*:*:*:*:*",
              "matchCriteriaId": "1E5C52F3-2109-40FD-9945-A9A9D42C076E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.0.4:-:windows:*:*:*:*:*",
              "matchCriteriaId": "151DEB6D-5857-4B0B-8449-5735768024A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1:-:windows:*:*:*:*:*",
              "matchCriteriaId": "AC7E7F65-8F3B-42F8-8B2D-9EA1CC4A4300",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1.1:-:windows:*:*:*:*:*",
              "matchCriteriaId": "476EBE1F-66E1-4EF5-8344-BEDA97F306A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.1.2:-:windows:*:*:*:*:*",
              "matchCriteriaId": "480ED2AC-0DA4-44DA-A902-8534335077B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*",
              "matchCriteriaId": "77F31F4B-5305-4D75-9277-95EF99A969A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2.1:-:windows:*:*:*:*:*",
              "matchCriteriaId": "C9AD216D-0C95-4843-A1A1-C3C9A6219277",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:3.2.2:-:windows:*:*:*:*:*",
              "matchCriteriaId": "04B8652D-BE06-49CB-A636-8B53B2DF9168",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados en Web Inspector en WebKit in Apple Safari anterior a v4.0, permite a atacantes asistidos por el usuario, inyectar secuencias comandos web o HTML de su elecci\u00f3n y leer archivos locales, a trav\u00e9s de vectores relacionado con caracteres de escape HTML inapropiados."
    }
  ],
  "id": "CVE-2009-1714",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-06-10T18:00:00.843",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/55023"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35379"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/37746"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/43068"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1022344"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT3613"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1950"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/35260"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/35348"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1522"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2011/0212"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51268"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/55023"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35379"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/37746"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/43068"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1022344"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT3613"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1950"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/35260"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/35348"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1522"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2011/0212"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51268"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.