VulnerabilityModified
CVE-2012-3714
The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill popover, which allows remote attackers to obtain the Me card from an Address Book via a crafted web site.
MEDIUM 4.3EPSS 0.92%
Does this matter?
Lower severity and a low EPSS score (0.92%). Track it; it rarely justifies an emergency change on its own.
Description
The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill popover, which allows remote attackers to obtain the Me card from an Address Book via a crafted web site.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 0.92% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-264
- Affected
- apple/safari
- Source
- product-security@apple.com
References
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00005.html
- http://osvdb.org/85653
- http://support.apple.com/kb/HT5502Vendor Advisory
- http://www.securityfocus.com/bid/55625
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78681
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00005.html
- http://osvdb.org/85653
- http://support.apple.com/kb/HT5502Vendor Advisory
- http://www.securityfocus.com/bid/55625
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78681
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.