CVE-2015-3752

The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and…

published August 16, 2015

CVSS
—
EPSS
3%
Percentile
87.3
In the wild
Unconfirmed
What it is

The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03020 · 87.3th percentile
Published
2015-08-16T23:00Z
EPSS history
Timeline
  • 16 AUG 23:00Z
    The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and…
    cvelistv5