CVE-2015-3658

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-07-03 · updated 2026-06-17
Weakness: CWE-254

Description

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.

Affected products

Apple Iphone Os: through 8.3
macOS: through 10.10.3
Apple Safari: through 6.2.6; 7.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5 (+15)

References

http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
http://support.apple.com/kb/HT204941
http://support.apple.com/kb/HT204950
http://www.securityfocus.com/bid/75492
http://www.securitytracker.com/id/1032754
http://www.ubuntu.com/usn/USN-2937-1
http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
http://support.apple.com/kb/HT204941

Get alerted when CVE-2015-3658 or the next vulnerability affects your stack