CVE-2015-1126

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

9.89% chance of exploitation in the next 30 days, 96th percentile

Published

2015-04-10

Updated

2024-08-06

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/apple_safari_ftp_url_coo…

Security advisories

• http://lists.apple.com/archives/security-announce/2015/Apr/msg00000.html
• http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html
• https://support.apple.com/HT204658
• https://support.apple.com/HT204661

References

• CVE Record
• NVD entry