CVE-2008-6059 xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attacker...
MediumCVSS 5.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webkit | All versions | No fix listed |
References
- trac.webkit.org
- 33804 vdb-entry
- bugs.webkit.org
- webkit-xmlhttprequest-info-disclosure(48575) vdb-entry