{"api_version":"1","generated_at":"2026-07-23T11:51:13+00:00","cve":"CVE-2007-2400","urls":{"html":"https://cve.report/CVE-2007-2400","api":"https://cve.report/api/cve/CVE-2007-2400.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-2400","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-2400"},"summary":{"title":"CVE-2007-2400","description":"Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-06-25 19:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","CWE-362","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/26287","name":"http://secunia.com/advisories/26287","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Apple iPhone Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/24599","name":"http://www.securityfocus.com/bid/24599","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Apple Safari Cross-Domain Race Condition Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://osvdb.org/36452","name":"http://osvdb.org/36452","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.kb.cert.org/vuls/id/289988","name":"http://www.kb.cert.org/vuls/id/289988","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"US-CERT Vulnerability Note VU#289988","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html","name":"http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"APPLE-SA-2007-06-22 Safari 3 Beta Update 3.0.2","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/2316","name":"http://www.vupen.com/english/advisories/2007/2316","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1018282","name":"http://www.securitytracker.com/id?1018282","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"SecurityTracker.com Archives - Apple Safari Bugs Let Remote Users Modify the Address Bar and Conduct Cross-Domain Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/2731","name":"http://www.vupen.com/english/advisories/2007/2731","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://docs.info.apple.com/article.html?artnum=306173","name":"http://docs.info.apple.com/article.html?artnum=306173","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of iPhone v1.0.1 Update","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2400","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2400","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"2400","vulnerable":"1","versionEndIncluding":"1.0","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"iphone_os","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2400","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2400","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"safari","cpe6":"3.0","cpe7":"*","cpe8":"windows","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2400","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"safari","cpe6":"3.0.1","cpe7":"*","cpe8":"windows","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2400","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_vista","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"2400","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_xp","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T13:33:28.684Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"36452","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/36452"},{"name":"ADV-2007-2316","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/2316"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://docs.info.apple.com/article.html?artnum=306173"},{"name":"APPLE-SA-2007-06-22","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html"},{"name":"1018282","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1018282"},{"name":"24599","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/24599"},{"name":"26287","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/26287"},{"name":"VU#289988","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/289988"},{"name":"ADV-2007-2731","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/2731"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-06-22T00:00:00.000Z","descriptions":[{"lang":"en","value":"Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2007-08-09T09:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"36452","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/36452"},{"name":"ADV-2007-2316","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/2316"},{"tags":["x_refsource_CONFIRM"],"url":"http://docs.info.apple.com/article.html?artnum=306173"},{"name":"APPLE-SA-2007-06-22","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html"},{"name":"1018282","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1018282"},{"name":"24599","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/24599"},{"name":"26287","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/26287"},{"name":"VU#289988","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/289988"},{"name":"ADV-2007-2731","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/2731"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-2400","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"36452","refsource":"OSVDB","url":"http://osvdb.org/36452"},{"name":"ADV-2007-2316","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/2316"},{"name":"http://docs.info.apple.com/article.html?artnum=306173","refsource":"CONFIRM","url":"http://docs.info.apple.com/article.html?artnum=306173"},{"name":"APPLE-SA-2007-06-22","refsource":"APPLE","url":"http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html"},{"name":"1018282","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1018282"},{"name":"24599","refsource":"BID","url":"http://www.securityfocus.com/bid/24599"},{"name":"26287","refsource":"SECUNIA","url":"http://secunia.com/advisories/26287"},{"name":"VU#289988","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/289988"},{"name":"ADV-2007-2731","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/2731"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-2400","datePublished":"2007-06-25T19:00:00.000Z","dateReserved":"2007-04-30T00:00:00.000Z","dateUpdated":"2024-08-07T13:33:28.684Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-06-25 19:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","CWE-362","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndIncluding":"1.0","matchCriteriaId":"6095A36B-BE17-4F65-81E6-2CAFACDF9577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*","matchCriteriaId":"0FF5999A-9D12-4CDD-8DE9-A89C10B2D574"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*","matchCriteriaId":"3852BB02-47A1-40B3-8E32-8D8891A53114"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*","matchCriteriaId":"E61F1C9B-44AF-4B35-A7B2-948EEF7639BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:safari:3.0:*:windows:*:*:*:*:*","matchCriteriaId":"A588615E-EE35-4E19-8BDA-598ED9664686"},{"vulnerable":true,"criteria":"cpe:2.3:a:apple:safari:3.0.1:*:windows:*:*:*:*:*","matchCriteriaId":"3E61C168-482B-412A-97E8-B1C651797EDF"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"2400","Ordinal":"1","Title":"CVE-2007-2400","CVE":"CVE-2007-2400","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"2400","Ordinal":"1","NoteData":"Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.","Type":"Description","Title":"CVE-2007-2400"},{"CveYear":"2007","CveId":"2400","Ordinal":"2","NoteData":"2007-06-25","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"2400","Ordinal":"3","NoteData":"2007-08-09","Type":"Other","Title":"Modified"}]}}}