CVE-2014-1257

CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation.

Affected products

Cfnetwork, Os X, Safari

Apple Mac Os X

≤ 10.8.5, 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4

CVSS 2.0

3.6 LOW

EPSS

0.4% (29th percentile)

Weakness

CWE-264

NVD status

Modified

Published

2014-02-27