CVE-2008-1009: XSS
Published Mar 19, 2008
·Updated
Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary JavaScript by modifying the history object.
Affected Software
16 affected components
Safari=1.3.2
Safari=3.0.4
Safari=2.0.2
Safari=3.0.1
Safari=3.0.2
Safari=1.0
Safari=1.3
Safari=3.0.3
Safari=2.0
Safari=0.8
Safari=2.0.4
Safari=1.1
Safari=1.3.1
Safari=1.2
Safari=3.0
Safari=0.9
Remediation
Event History
Mar 19, 2008
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-1009?
CVE-2008-1009 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2008-1009?
To fix CVE-2008-1009, upgrade to a version of Apple Safari that is newer than version 3.1.
3
What versions of Apple Safari are affected by CVE-2008-1009?
CVE-2008-1009 affects Apple Safari versions 1.0 to 3.0.4.
4
What type of attack does CVE-2008-1009 enable?
CVE-2008-1009 enables attackers to inject arbitrary JavaScript into WebCore through the history object.
5
Can CVE-2008-1009 lead to data theft?
Yes, CVE-2008-1009 can potentially lead to data theft as it allows execution of malicious scripts.