CVE-2007-2401: apple mac_os_x Cross-site Scripting
Vulnerability summary
CVE-2007-2401 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in apple mac_os_x. EPSS estimates a 7.06% chance of exploitation in the next 30 days, higher than 94.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 25-06-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function. NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
7.06%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.06% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundApple WebCore - XMLHTTPRequest Cross-Site Scripting
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Apple2 products
- mac_os_x10.3.9 | 10.4.9
- mac_os_x_server10.3.9 | 10.4.9
1 vendor · 2 products
References
15 links- docs.info.apple.com/article.html?artnum=306173X Refsource CONFIRM
- lists.apple.com/archives/Security-announce/2007/Jun/msg00003.htmlVendor AdvisoryX Refsource APPLEPatch
- docs.info.apple.com/article.html?artnum=305759X Refsource CONFIRM