CVE-2007-2580 Information disclosure in n/a
Local attackers can retrieve saved keychain passwords from Apple Safari via malicious AppleScript, requiring user interaction to execute the script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2007-2580?
CVE-2007-2580 is a low-severity vulnerability in Apple Safari, published on 9 May 2007. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Unspecified vulnerability in Apple Safari allows local users to obtain sensitive information (saved keychain passwords) via the document.loginform.password.value JavaScript parameter loaded from an AppleScript script.
Which versions are affected by CVE-2007-2580?
It affects 1 product.
Products include Apple Safari.
How do I fix CVE-2007-2580?
No fix has been published for CVE-2007-2580 yet. Limit exposure of the affected software until one is available.
Is CVE-2007-2580 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-2580 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Apple Safari
Sources
Also known as GHSA-85qr-hv25-pvmw.