CVE-2007-2401

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-06-25 · updated 2026-06-16
Weakness: CWE-79

Description

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function. NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.

Affected products

macOS: 10.3.9, 10.4.9
Apple Mac Os X Server: 10.3.9, 10.4.9

References

http://docs.info.apple.com/article.html?artnum=305759
http://docs.info.apple.com/article.html?artnum=306173
http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html
http://osvdb.org/36449
http://secunia.com/advisories/25786
http://secunia.com/advisories/26287
http://www.kb.cert.org/vuls/id/845708
http://www.securityfocus.com/archive/1/472198/100/0/threaded
http://www.securityfocus.com/bid/24598
http://www.securitytracker.com/id?1018281
http://www.vupen.com/english/advisories/2007/2296
http://www.vupen.com/english/advisories/2007/2316

Get alerted when CVE-2007-2401 or the next vulnerability affects your stack