CVE-2017-2445

MEDIUM

Apple Safari < 10.0.3 - XSS

Title source: rule

Description

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · htmlwebappsmultiple

https://www.exploit-db.com/exploits/41802

View Code ZIP pw:eip

References (7)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97130

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1038137

[Vendor Advisory] https://support.apple.com/HT207600

[Vendor Advisory] https://support.apple.com/HT207601

[Vendor Advisory] https://support.apple.com/HT207617

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/41802/

[Third Party Advisory] https://security.gentoo.org/glsa/201706-15

Scores

CVSS v3 6.1

EPSS 0.0113

EPSS Percentile 78.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status published

Affected Products (4)

apple/safari < 10.0.3

apple/iphone_os < 10.2.1

apple/tvos < 10.1.1

n/a/n/a

Timeline

Published Apr 02, 2017

Tracked Since Feb 18, 2026