What’s Vulnerable › Vulnerabilities

CVE-2009-2816

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-11-13 · updated 2026-06-16
• Weakness: CWE-352

Description

The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.

Affected products

• Apple Iphone Os: before 4.0 — fixed in 4.0
• Apple Safari: before 4.0.4 — fixed in 4.0.4
• Fedoraproject Fedora: 11, 12
• Google Chrome: before 3.0.195.33 — fixed in 3.0.195.33
• Opensuse: 11.2, 11.3

How to fix

Upgrade to a fixed version: Apple Iphone Os 4.0; Apple Safari 4.0.4; Google Chrome 3.0.195.33. Check the vendor advisory for mitigations.

References

• http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html
• http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
• http://osvdb.org/59940
• http://osvdb.org/59967
• http://secunia.com/advisories/37346
• http://secunia.com/advisories/37358
• http://secunia.com/advisories/37393
• http://secunia.com/advisories/37397
• http://secunia.com/advisories/43068
• http://support.apple.com/kb/HT3949
• http://support.apple.com/kb/HT4225

Get alerted when CVE-2009-2816 or the next vulnerability affects your stack