CVE-2008-6059: Medium severity WebKit Webkit vulnerability

Published Feb 5, 2009

Updated

xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.

Affected Software

1 affected component

WebKit Webkit

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WebKit to a version that resolves this vulnerability.
Fixed in r38566

Event History

Feb 5, 2009

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·12:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-6059?

CVE-2008-6059 is classified as a high severity vulnerability due to its potential to expose sensitive cookie information.

How do I fix CVE-2008-6059?

To fix CVE-2008-6059, update to a version of WebKit that is r38566 or later, which addresses the cookie exposure issue.

What type of attack is CVE-2008-6059 related to?

CVE-2008-6059 is related to unauthorized access to sensitive information via XMLHttpRequest calls.

Which software is affected by CVE-2008-6059?

CVE-2008-6059 affects various versions of the WebKit framework prior to r38566.

What specific headers are involved in CVE-2008-6059?

CVE-2008-6059 involves the improper restriction access to the Set-Cookie and Set-Cookie2 HTTP response headers.