CVE-2008-1006
Status: ModifiedMedium (4.3)—
Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Base score: 4.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.83%
- Percentile among all scored CVEs: 78
- Score date: 10/9/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-79
References
- http://docs.info.apple.com/article.html?artnum=307563
- http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html
- http://secunia.com/advisories/29393
- http://www.securityfocus.com/bid/28290
- http://www.securityfocus.com/bid/28332
- http://www.securitytracker.com/id?1019653
- http://www.us-cert.gov/cas/techalerts/TA08-079A.html
- http://www.vupen.com/english/advisories/2008/0920/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41326
- http://docs.info.apple.com/article.html?artnum=307563
- http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html
- http://secunia.com/advisories/29393
- http://www.securityfocus.com/bid/28290
- http://www.securityfocus.com/bid/28332
- http://www.securitytracker.com/id?1019653
- http://www.us-cert.gov/cas/techalerts/TA08-079A.html
- http://www.vupen.com/english/advisories/2008/0920/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41326
Raw JSON (NVD)
Show
{
"id": "CVE-2008-1006",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2008-03-19T00:44:00.000",
"references": [
{
"url": "http://docs.info.apple.com/article.html?artnum=307563",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/29393",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/28290",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/28332",
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id?1019653",
"source": "cve@mitre.org"
},
{
"url": "http://www.us-cert.gov/cas/techalerts/TA08-079A.html",
"tags": [
"US Government Resource"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2008/0920/references",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41326",
"source": "cve@mitre.org"
},
{
"url": "http://docs.info.apple.com/article.html?artnum=307563",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/29393",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/28290",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/28332",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1019653",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.us-cert.gov/cas/techalerts/TA08-079A.html",
"tags": [
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2008/0920/references",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41326",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Webcore, usado en Apple Safari anterior a 3.1, permite a atacantes remotos inyectar secuencias de comandos web o html de su elección empleando la función windows.open para cambiar el contexto de seguridad de una página web."
}
],
"lastModified": "2026-06-16T22:50:47.440",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09F4ADD0-449B-4DDD-9878-DE86CBD56756"
},
{
"criteria": "cpe:2.3:a:apple:safari:0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E0AECB7-FE62-4664-B3B8-8161DA6DA4BC"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1A419AE8-F5A2-4E25-9004-AAAB325E201A"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "857C92E2-6870-409A-9457-75F8C5C7B959"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "443FF271-A3AB-4659-80B2-89F771BF5371"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4EDD80AB-2A6C-47FF-A1E9-DEB273C6B4E5"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9315ADD-5B97-4639-9B59-806EFD7BC247"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7DD81AB-27D6-4CB0-BBF0-5710DAD55A3D"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D3889ED-9329-4C84-A173-2553BEAE3EDA"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06494FA8-F12A-435A-97A4-F38C58DF43F2"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFDCF83E-620C-40FA-9901-5D939E315143"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A33F900-D405-40A8-A0A5-3C80320FF6E9"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CEB23DE-1A9D-480E-8B8B-9F110A8ABDE6"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84E78F43-07BD-4D62-9512-DA738A92BC7B"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3180366-2240-467E-8AB9-BEA0430948F1"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AB9CC52-E533-4306-9E92-73C84B264D4E"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}