CVE-2015-3729

Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.apple.com/kb/HT205033	Vendor Advisory
https://support.apple.com/kb/HT205030	Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html	Mailing List Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html	Mailing List Vendor Advisory
http://www.securityfocus.com/bid/76342	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1033274	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:a:apple:safari::::::::

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Information

Published : 2015-08-16 16:59

Updated : 2019-02-08 08:22

NVD link : CVE-2015-3729

Mitre link : CVE-2015-3729

JSON object : View

CWE

CWE-254

7PK - Security Features

Products Affected

apple

safari
iphone_os

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://support.apple.com/kb/HT205033", "name": "https://support.apple.com/kb/HT205033", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://support.apple.com/kb/HT205030", "name": "https://support.apple.com/kb/HT205030", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html", "name": "APPLE-SA-2015-08-13-1", "tags": ["Mailing List", "Vendor Advisory"], "refsource": "APPLE"}, {"url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html", "name": "APPLE-SA-2015-08-13-3", "tags": ["Mailing List", "Vendor Advisory"], "refsource": "APPLE"}, {"url": "http://www.securityfocus.com/bid/76342", "name": "76342", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1033274", "name": "1033274", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-254"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-3729", "ASSIGNER": "product-security@apple.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2015-08-16T23:59Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.2.8", "versionStartIncluding": "6.0"}, {"cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "7.1.8", "versionStartIncluding": "7.0"}, {"cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "8.0.8", "versionStartIncluding": "8.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false, "versionEndExcluding": "8.4.1"}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-02-08T16:22Z"}

4.3 /10