CVE-2009-2816
13.11.2009, 15:30
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
| Vendor | Product | Version |
|---|---|---|
| apple | safari | 𝑥 < 4.0.4 |
| chrome | 𝑥 < 3.0.195.33 | |
| apple | iphone_os | 𝑥 < 4.0 |
| opensuse | opensuse | 11.2 |
| opensuse | opensuse | 11.3 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
References