CVE-2015-3752
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.
- Apple Safari
- < 6.2.8, 7.1.8, 8.0.8
- Fix
- Available
- CVSS 2.0
- 5.0 MEDIUM
- EPSS
- 2.8% (85th percentile)
- Weakness
- CWE-200
- NVD status
- Modified
- Published
- 2015-08-16
CVE-2015-3752 at NVD
No indexed exploits for CVE-2015-3752 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2015-3752 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.