5

CVE-2011-3246

CFNetwork in Apple iOS before 5.0.1 and Mac OS X 10.7 before 10.7.2 does not properly parse URLs, which allows remote attackers to trigger visits to unintended web sites, and transmission of cookies to unintended web sites, via a crafted (1) http or (2) https URL.

Data is provided by the National Vulnerability Database (NVD)
Apple ≫ macOS X Version10.7.0
Apple ≫ macOS X Version10.7.1
Apple ≫ macOS X Server Version10.7.0
Apple ≫ macOS X Server Version10.7.1
Apple ≫ iPhone OS Version3.0 Update- Editioniphone
Apple ≫ iPhone OS Version3.1
Apple ≫ iPhone OS Version3.1 Update- Editioniphone
Apple ≫ iPhone OS Version3.1 Update- Editionipodtouch
Apple ≫ iPhone OS Version3.1.2 Update- Editioniphone
Apple ≫ iPhone OS Version3.1.3 Update- Editioniphone
Apple ≫ iPhone OS Version3.2 Update- Editioniphone
Apple ≫ iPhone OS Version3.2 Update- Editionipodtouch
Apple ≫ iPhone OS Version3.2.1
Apple ≫ iPhone OS Version3.2.1 Update- Editionipad
Apple ≫ iPhone OS Version3.2.2
Apple ≫ iPhone OS Version4.0
Apple ≫ iPhone OS Version4.0 Update- Editioniphone
Apple ≫ iPhone OS Version4.0 Update- Editionipodtouch
Apple ≫ iPhone OS Version4.0.1
Apple ≫ iPhone OS Version4.0.1 Update- Editioniphone
Apple ≫ iPhone OS Version4.0.1 Update- Editionipodtouch
Apple ≫ iPhone OS Version4.0.2
Apple ≫ iPhone OS Version4.1
Apple ≫ iPhone OS Version4.2.1
Apple ≫ iPhone OS Version4.2.5
Apple ≫ iPhone OS Version4.2.8
Apple ≫ iPhone OS Version4.3.0
Apple ≫ iPhone OS Version4.3.1
Apple ≫ iPhone OS Version4.3.2
Apple ≫ iPhone OS Version4.3.3
Apple ≫ iPhone OS Version4.3.5
Apple ≫ iPhone OS Version4.3.5 Update- Editionipad
Apple ≫ iPhone OS Version4.3.5 Update- Editionipodtouch
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.94% 0.753
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.