Information disclosure in Apple Safari
CVE-2012-0647
WebKit in Apple Safari before 5.1.4 does not properly handle redirects in conjunction with HTTP authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header.
Vulnerability class: Information Disclosure
EPSS: 0.011 (62.9th percentile) — read the EPSS interpretation.
Affected products
- Apple Safari — versions 1.0, 1.0.0, 1.0.0b1
- N/a — versions n/a
Weakness classification (CWE)
References
- product-security@apple.com (x_refsource_SECUNIA, third-party-advisory)
- product-security@apple.com (vdb-entry, x_refsource_SECTRACK)
- product-security@apple.com (vendor-advisory, x_refsource_APPLE)