{"api_version":"1","generated_at":"2026-07-23T11:06:21+00:00","cve":"CVE-2015-3729","urls":{"html":"https://cve.report/CVE-2015-3729","api":"https://cve.report/api/cve/CVE-2015-3729.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-3729","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3729"},"summary":{"title":"CVE-2015-3729","description":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.","state":"PUBLISHED","assigner":"apple","published_at":"2015-08-16 23:59:01","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-254","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1033274","name":"http://www.securitytracker.com/id/1033274","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Apple Safari Flaws Let Remote Users Bypass Security Controls, Obtain Potentially Sensitive Information, Spoof Interfaces and URLS, and Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/kb/HT205033","name":"https://support.apple.com/kb/HT205033","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/76342","name":"http://www.securityfocus.com/bid/76342","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Apple Safari CVE-2015-3729 Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://support.apple.com/kb/HT205030","name":"https://support.apple.com/kb/HT205030","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of iOS 8.4.1 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html","name":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"],"title":"APPLE-SA-2015-08-13-3 iOS 8.4.1","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html","name":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"],"title":"APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3729","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3729","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"3729","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"safari","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T05:56:15.225Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1033274","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1033274"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/kb/HT205030"},{"name":"APPLE-SA-2015-08-13-3","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"},{"name":"76342","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/76342"},{"name":"APPLE-SA-2015-08-13-1","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/kb/HT205033"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-08-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-22T18:57:01.000Z","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","shortName":"apple"},"references":[{"name":"1033274","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1033274"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/kb/HT205030"},{"name":"APPLE-SA-2015-08-13-3","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"},{"name":"76342","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/76342"},{"name":"APPLE-SA-2015-08-13-1","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/kb/HT205033"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"product-security@apple.com","ID":"CVE-2015-3729","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1033274","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1033274"},{"name":"https://support.apple.com/kb/HT205030","refsource":"CONFIRM","url":"https://support.apple.com/kb/HT205030"},{"name":"APPLE-SA-2015-08-13-3","refsource":"APPLE","url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"},{"name":"76342","refsource":"BID","url":"http://www.securityfocus.com/bid/76342"},{"name":"APPLE-SA-2015-08-13-1","refsource":"APPLE","url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html"},{"name":"https://support.apple.com/kb/HT205033","refsource":"CONFIRM","url":"https://support.apple.com/kb/HT205033"}]}}}},"cveMetadata":{"assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","assignerShortName":"apple","cveId":"CVE-2015-3729","datePublished":"2015-08-16T23:00:00.000Z","dateReserved":"2015-05-07T00:00:00.000Z","dateUpdated":"2024-08-06T05:56:15.225Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-08-16 23:59:01","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-254","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.2.8","matchCriteriaId":"47782F4A-23C6-4F74-B4D1-DE59356AA9AB"},{"vulnerable":true,"criteria":"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.1.8","matchCriteriaId":"2532A5EF-F419-4D51-BFB0-70AA3269691B"},{"vulnerable":true,"criteria":"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0","versionEndExcluding":"8.0.8","matchCriteriaId":"D5A5B82D-B522-4F3F-B46B-DA1317F75C60"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"8.4.1","matchCriteriaId":"F597127C-D985-43BC-AE13-8E076B270CC4"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"3729","Ordinal":"1","Title":"CVE-2015-3729","CVE":"CVE-2015-3729","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"3729","Ordinal":"1","NoteData":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.","Type":"Description","Title":"CVE-2015-3729"},{"CveYear":"2015","CveId":"3729","Ordinal":"2","NoteData":"2015-08-16","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"3729","Ordinal":"3","NoteData":"2016-12-22","Type":"Other","Title":"Modified"}]}}}