← Database

CVE-2009-2200

HIGH CVSS: 7.1 Published: 2009-08-12 Modified: 2026-06-16

Description

WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document.

Affected Platforms

Apple SafariMicrosoft Windows XpApple Mac Os XMicrosoft Windows VistaApple Mac Os X Server

Weakness Type

CWE-200

References