CVE-2009-2797
Medium
Description
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
SeverityMedium
CVSS5.0
Exploit probability—
Product
Apple Iphone Os
PublishedSep 10, 2009
First seenSep 10, 2009
How to fix
Update
- apple iphone_os3.1, 3.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple iphone_os | v < 3.1, v < 3.1.1 | 3.1, 3.1.1 |
| canonical ubuntu_linux | 9.10, 10.04, 10.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.