{"schemaVersion":3,"id":"CVE-2007-2401","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function.  NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.","dates":{"published":"2007-06-25T19:00:00.000Z","modified":"2024-08-07T13:33:28.923Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0706,"percentile":0.94144,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0706},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0706,"percentile":0.94144}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0706,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0706,"percentile":0.94144}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"30228","name":"Apple WebCore - XMLHTTPRequest Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/30228","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["osx"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"osx","file":"exploits/osx/remote/30228.txt","codes":["CVE-2007-2401","OSVDB-36449"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"apple","product":"mac_os_x","name":"mac os x","label":"mac_os_x","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.3.9","noFixRecorded":false,"fixedIn":null},{"text":"10.4.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.3.9 | 10.4.9","eol":null,"hubHref":"/vendor/apple/mac_os_x"},{"vendor":"apple","product":"mac_os_x_server","name":"mac os x server","label":"mac_os_x_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.3.9","noFixRecorded":false,"fixedIn":null},{"text":"10.4.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.3.9 | 10.4.9","eol":null,"hubHref":"/vendor/apple/mac_os_x_server"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.vupen.com/english/advisories/2007/2316","label":"www.vupen.com/english/advisories/2007/2316","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://docs.info.apple.com/article.html?artnum=306173","label":"docs.info.apple.com/article.html?artnum=306173","hostname":"docs.info.apple.com","tags":["X Refsource CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35017","label":"exchange.xforce.ibmcloud.com/vulnerabilities/35017","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html","label":"lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Patch"]},{"url":"http://secunia.com/advisories/25786","label":"secunia.com/advisories/25786","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]},{"url":"http://www.westpoint.ltd.uk/advisories/wp-07-0002.txt","label":"www.westpoint.ltd.uk/advisories/wp-07-0002.txt","hostname":"www.westpoint.ltd.uk","tags":["X Refsource MISC","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/26287","label":"secunia.com/advisories/26287","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/472198/100/0/threaded","label":"www.securityfocus.com/archive/1/472198/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://docs.info.apple.com/article.html?artnum=305759","label":"docs.info.apple.com/article.html?artnum=305759","hostname":"docs.info.apple.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.securityfocus.com/bid/24598","label":"www.securityfocus.com/bid/24598","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Patch"]},{"url":"http://www.vupen.com/english/advisories/2007/2731","label":"www.vupen.com/english/advisories/2007/2731","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://osvdb.org/36449","label":"osvdb.org/36449","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"http://www.securitytracker.com/id?1018281","label":"www.securitytracker.com/id?1018281","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Patch"]},{"url":"http://www.vupen.com/english/advisories/2007/2296","label":"www.vupen.com/english/advisories/2007/2296","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.kb.cert.org/vuls/id/845708","label":"www.kb.cert.org/vuls/id/845708","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2007-06-25T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T13:33:28.923Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":29,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T00:07:56.838Z","stale":false,"partial":false}}