CVE-2009-2066

State: Published
Severity: Not scored
Published: Jun 15, 2009
Updated: Aug 7, 2024
Reserved: Jun 15, 2009

Description

Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

35403vdb-entry
http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf
safari-http-security-bypass(51187)vdb-entry
http://research.microsoft.com/apps/pubs/default.aspx?id=79323

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.