4.3
CVE-2014-1296
- EPSS 1.88%
- Veröffentlicht 23.04.2014 11:52:59
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Erkennungen
LoginCFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ macOS X Server Version 10.7.0
Apple ≫ macOS X Server Version 10.7.1
Apple ≫ macOS X Server Version 10.7.2
Apple ≫ macOS X Server Version 10.7.3
Apple ≫ macOS X Server Version 10.7.4
Apple ≫ macOS X Server Version 10.7.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.88% | 0.767 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html
http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html
http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html