CVE-2009-2200
Last modified
CVE-2009-2200 is a vulnerability of currently unknown severity. WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document.. EPSS estimates a 2.39% chance of exploitation in the next 30 days.
Description
WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apple | Safari | <= 4.0.2 | — |
| Apple | Safari | 0.8 | — |
| Apple | Safari | 0.9 | — |
| Apple | Safari | 1.0 | — |
| Apple | Safari | 1.0.0 | — |
| Apple | Safari | 1.0.0b1 | — |
| Apple | Safari | 1.0.0b2 | — |
| Apple | Safari | 1.0.1 | — |
| Apple | Safari | 1.0.2 | — |
| Apple | Safari | 1.0.3 | — |
| Apple | Safari | 1.1 | — |
| Apple | Safari | 1.1.0 | — |
| Apple | Safari | 1.1.1 | — |
| Apple | Safari | 1.2 | — |
| Apple | Safari | 1.2.0 | — |
| Apple | Safari | 1.2.1 | — |
| Apple | Safari | 1.2.2 | — |
| Apple | Safari | 1.2.3 | — |
| Apple | Safari | 1.2.4 | — |
| Apple | Safari | 1.2.5 | — |
| Apple | Safari | 1.3 | — |
| Apple | Safari | 1.3.0 | — |
| Apple | Safari | 1.3.1 | — |
| Apple | Safari | 1.3.2 | — |
| Apple | Safari | 2.0 | — |
| Apple | Safari | 2.0.0 | — |
| Apple | Safari | 2.0.1 | — |
| Apple | Safari | 2.0.2 | — |
| Apple | Safari | 2.0.3 | — |
| Apple | Safari | 2.0.3_417.9.3 | — |
| Apple | Safari | 2.0.4 | — |
| Apple | Safari | 2.0.4_419.3 | — |
| Apple | Safari | 2.0_pre | — |
| Apple | Safari | 3 | — |
| Apple | Safari | 3.0 | — |
| Apple | Safari | 3.0.0 | — |
| Apple | Safari | 3.0.0b | — |
| Apple | Safari | 3.0.1 | — |
| Apple | Safari | 3.0.1b | — |
| Apple | Safari | 3.0.2 | — |
| Apple | Safari | 3.0.2b | — |
| Apple | Safari | 3.0.3 | — |
| Apple | Safari | 3.0.3b | — |
| Apple | Safari | 3.0.4 | — |
| Apple | Safari | 3.0.4_beta | — |
| Apple | Safari | 3.0.4b | — |
| Apple | Safari | 3.1 | — |
| Apple | Safari | 3.1.0 | — |
| Apple | Safari | 3.1.0b | — |
| Apple | Safari | 3.1.1 | — |
Showing 50 of 60 affected configurations. See NVD for the full list.
References
- http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.htmlPatch, Vendor Advisory
- http://support.apple.com/kb/HT3733Patch, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.htmlPatch, Vendor Advisory
- http://support.apple.com/kb/HT3733Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-2200?
How severe is CVE-2009-2200?
How do I fix CVE-2009-2200?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-2194Apple Mac OS X 10.5 before 10.5.8 does not properly share fi…
- CVE-2009-2195Buffer overflow in WebKit in Apple Safari before 4.0.3 allow…
- CVE-2009-2196Unspecified vulnerability in Apple Safari 4 before 4.0.3 all…
- CVE-2009-2197Apple Safari before 9.1 allows remote attackers to spoof the…
- CVE-2009-2198Apple GarageBand before 5.1 reconfigures Safari to accept al…
- CVE-2009-2199Incomplete blacklist vulnerability in WebKit in Apple Safari…
- CVE-2009-2201The screensharing feature in the Admin application in Apple …
- CVE-2009-2202Apple QuickTime before 7.6.4 allows remote attackers to exec…
- CVE-2009-2203Buffer overflow in Apple QuickTime before 7.6.4 allows remot…
- CVE-2009-2204Unspecified vulnerability in the CoreTelephony component in …
- CVE-2009-2205Stack-based buffer overflow in the Java Web Start command la…
- CVE-2009-2206Multiple heap-based buffer overflows in the AudioCodecs libr…
Are you affected by CVE-2009-2200?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST