CVE-2008-1003: XSS

Published Mar 19, 2008

Updated

Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to sites that set the document.domain property or have the same document.domain.

Affected Software

16 affected components

Safari=1.3.2

Safari=3.0.4

Safari=2.0.2

Safari=3.0.1

Safari=3.0.2

Safari=1.0

Safari=1.3

Safari=3.0.3

Safari=2.0

Safari=0.8

Safari=2.0.4

Safari=1.1

Safari=1.3.1

Safari=1.2

Safari=3.0

Safari=0.9

Remediation

Patch Available

http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html

Event History

Mar 19, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1003?

CVE-2008-1003 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2008-1003?

To fix CVE-2008-1003, upgrade to a newer version of Apple Safari that has addressed this vulnerability.

What versions of Apple Safari are affected by CVE-2008-1003?

CVE-2008-1003 impacts multiple versions of Apple Safari, specifically versions prior to 3.1.

What type of vulnerability is CVE-2008-1003?

CVE-2008-1003 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML.

Can CVE-2008-1003 be exploited without user interaction?

Exploitation of CVE-2008-1003 may not require user interaction, as it involves arbitrary scripts running in the context of the user’s browser.