CVE-2015-3658
Summary
| CVE | CVE-2015-3658 |
|---|---|
| State | PUBLISHED |
| Assigner | apple |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-07-03 01:59:17 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Apple | Iphone Os | All | All | All | All |
| Operating System | Apple | Mac Os X | All | All | All | All |
| Application | Apple | Safari | 7.0 | All | All | All |
| Application | Apple | Safari | 7.0.1 | All | All | All |
| Application | Apple | Safari | 7.0.2 | All | All | All |
| Application | Apple | Safari | 7.0.3 | All | All | All |
| Application | Apple | Safari | 7.0.4 | All | All | All |
| Application | Apple | Safari | 7.0.5 | All | All | All |
| Application | Apple | Safari | 7.0.6 | All | All | All |
| Application | Apple | Safari | 7.1.0 | All | All | All |
| Application | Apple | Safari | 7.1.1 | All | All | All |
| Application | Apple | Safari | 7.1.2 | All | All | All |
| Application | Apple | Safari | 7.1.3 | All | All | All |
| Application | Apple | Safari | 7.1.4 | All | All | All |
| Application | Apple | Safari | 7.1.5 | All | All | All |
| Application | Apple | Safari | 7.1.6 | All | All | All |
| Application | Apple | Safari | 8.0 | All | All | All |
| Application | Apple | Safari | 8.0.1 | All | All | All |
| Application | Apple | Safari | 8.0.2 | All | All | All |
| Application | Apple | Safari | 8.0.3 | All | All | All |
| Application | Apple | Safari | 8.0.4 | All | All | All |
| Application | Apple | Safari | 8.0.5 | All | All | All |
| Application | Apple | Safari | 8.0.6 | All | All | All |
| Application | Apple | Safari | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Apple Safari Bugs Let Remote Users Conduct Cross-Site Scripting, Cross-Site Request Forgery, and SQL Injection Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| USN-2937-1: WebKitGTK+ vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| openSUSE-SU-2016:0915-1: moderate: Security update for webkitgtk | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| About the security content of iOS 8.4 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Vendor Advisory |
| APPLE-SA-2015-06-30-4 Safari 8.0.7, Safari 7.1.7, and Safari 6.2.7 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Vendor Advisory |
| About the security content of Safari 8.0.7, Safari 7.1.7, and Safari 6.2.7 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Vendor Advisory |
| WebKit Multiple Security Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| APPLE-SA-2015-06-30-1 iOS 8.4 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.