Improper input validation in Apple Iphone OS
CVE-2011-0160
WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle redirects in conjunction with HTTP Basic Authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.015 (72.5th percentile) — read the EPSS interpretation.
Affected products
- Apple Iphone_os — versions 1.0.0, 1.0.1, 1.0.2
- Apple Safari — versions 1.0, 1.0.0, 1.0.0b1
- Apple Webkit
- N/a — versions n/a
Weakness classification (CWE)
References
- product-security@apple.com (x_refsource_CONFIRM, Vendor Advisory)
- product-security@apple.com (x_refsource_CONFIRM, Vendor Advisory)
- product-security@apple.com (vendor-advisory, x_refsource_APPLE, Vendor Advisory)
- product-security@apple.com (vendor-advisory, x_refsource_APPLE, Vendor Advisory)
- product-security@apple.com (vdb-entry, x_refsource_SECTRACK)