CVE-2009-2816
Medium
Description
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Apple Safari
PublishedNov 13, 2009
First seenNov 13, 2009
How to fix
Update
- apple safari4.0.4 or later
- google chrome3.0.195.33 or later
- apple iphone_os4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple safari | v < 4.0.4 | 4.0.4 |
| google chrome | v < 3.0.195.33 | 3.0.195.33 |
| apple iphone_os | v < 4.0 | 4.0 |
| opensuse opensuse | 11.2, 11.3 | — |
| fedoraproject fedora | 11, 12 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.