CVE-2009-2058

Apple Safari < 3.2.2 - Cross-Site Scripting via Proxy CONNECT Response

Title source: llm
STIX 2.1

Description

Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/51193

Scores

EPSS 0.0097
EPSS Percentile 57.3%

Details

CWE
CWE-287
Status published
Products (1)
apple/safari < 3.2.2
Published Jun 15, 2009
Tracked Since Feb 18, 2026