CVE-2009-2797
MEDIUM · CVSS 5.0EPSS 3.9%EU EUVD
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
Key facts
- CVSS score
- 5.0 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:N/A:N- Weakness (CWE)
- CWE-200
- EPSS score
- 3.9% (90th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2009-2787)
- Published
- September 10, 2009
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2009-2787 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- apple / iphone os
- apple / iphone os
- canonical / ubuntu linux
- canonical / ubuntu linux
- canonical / ubuntu linux
References
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html(Mailing List, Patch, Vendor Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html(Third Party Advisory)
- http://secunia.com/advisories/36677(Third Party Advisory)
- http://secunia.com/advisories/41856(Third Party Advisory)
- http://secunia.com/advisories/43068(Third Party Advisory)
- http://support.apple.com/kb/HT3860(Patch, Vendor Advisory)
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:039(Third Party Advisory)
- http://www.securityfocus.com/bid/36339(Third Party Advisory, VDB Entry)
- http://www.ubuntu.com/usn/USN-1006-1(Third Party Advisory)
- http://www.vupen.com/english/advisories/2010/2722(Third Party Advisory)
- http://www.vupen.com/english/advisories/2011/0212(Third Party Advisory)
- http://www.vupen.com/english/advisories/2011/0552(Third Party Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53187(Third Party Advisory, VDB Entry)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain