CVE-2007-2401: XSS
CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function. NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2401?
CVE-2007-2401 has a moderate severity level due to its ability to allow attackers to inject arbitrary HTTP headers.
How do I fix CVE-2007-2401?
To mitigate CVE-2007-2401, upgrade to a version of Mac OS X or iPhone OS that is not affected by the vulnerability.
What affected software versions are impacted by CVE-2007-2401?
CVE-2007-2401 affects Apple Mac OS X versions 10.3.9 and 10.4.9, as well as iPhone OS versions before 1.0.1.
Can CVE-2007-2401 lead to remote code execution?
CVE-2007-2401 does not directly lead to remote code execution but allows header injection which may be exploited further.
What types of attacks can exploit CVE-2007-2401?
CVE-2007-2401 can be exploited through CRLF injection attacks to manipulate HTTP responses and headers.