CVE-2009-2797 Information disclosure in n/a

Medium 5.0 Published 10 Sep 2009 Updated 7 Aug 2024

Remote attackers can obtain sensitive credentials from Referer headers due to improper URL sanitization in Safari on iOS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2009-2797?

CVE-2009-2797 is a medium-severity vulnerability in Apple Iphone Os, published on 10 Sep 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.

Weakness: CWE-200

Which versions are affected by CVE-2009-2797?

It affects 2 products.

Products include Apple Iphone Os, Canonical Ubuntu Linux.

How do I fix CVE-2009-2797?

No fix has been published for CVE-2009-2797 yet. Limit exposure of the affected software until one is available.

Is CVE-2009-2797 being exploited?

There is no known exploitation of CVE-2009-2797 in the wild and no public exploit code.

All Apple Iphone Os vulnerabilities

Sources

Also known as GHSA-j22q-m838-5xhc.