NetSight
IP …
medium6.8

CVE-2009-2816

The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certai…

Impact

The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.

Affected products

VendorProductAffected versions
AppleSafari
before 4.0.4
GoogleChrome
before 3.0.195.33
AppleIphone Os
before 4.0
OpensuseOpensuse
Versions 11.2, 11.3
FedoraprojectFedora
Versions 11, 12

Weakness classification

CWE-352

References