CVE-2009-1685
Status: ModifiedMedium (4.3)—
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML by overwriting the document.implementation property of (1) an embedded document or (2) a parent document.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Base score: 4.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.66%
- Percentile among all scored CVEs: 85
- Score date: 10/9/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-79
References
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://osvdb.org/54983
- http://secunia.com/advisories/35379
- http://secunia.com/advisories/43068
- http://securitytracker.com/id?1022344
- http://support.apple.com/kb/HT3613
- http://support.apple.com/kb/HT3639
- http://www.securityfocus.com/bid/35260
- http://www.securityfocus.com/bid/35319
- http://www.vupen.com/english/advisories/2009/1522
- http://www.vupen.com/english/advisories/2009/1621
- http://www.vupen.com/english/advisories/2011/0212
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://osvdb.org/54983
- http://secunia.com/advisories/35379
- http://secunia.com/advisories/43068
- http://securitytracker.com/id?1022344
- http://support.apple.com/kb/HT3613
- http://support.apple.com/kb/HT3639
- http://www.securityfocus.com/bid/35260
- http://www.securityfocus.com/bid/35319
- http://www.vupen.com/english/advisories/2009/1522
- http://www.vupen.com/english/advisories/2009/1621
- http://www.vupen.com/english/advisories/2011/0212
Raw JSON (NVD)
Show
{
"id": "CVE-2009-1685",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-06-10T14:30:00.280",
"references": [
{
"url": "http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html",
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/54983",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/35379",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/43068",
"source": "cve@mitre.org"
},
{
"url": "http://securitytracker.com/id?1022344",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://support.apple.com/kb/HT3613",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://support.apple.com/kb/HT3639",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/35260",
"tags": [
"Exploit"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/35319",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1522",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1621",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2011/0212",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/54983",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/35379",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/43068",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securitytracker.com/id?1022344",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://support.apple.com/kb/HT3613",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://support.apple.com/kb/HT3639",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/35260",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/35319",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1522",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1621",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2011/0212",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML by overwriting the document.implementation property of (1) an embedded document or (2) a parent document."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebKit en Apple Safari antes de v4.0 permite a atacantes remotos inyectar HTML o secuencias de comandos web arbitrarios sobrescribiendo la propiedad document.implementation de (1) un documento embebido o (2) un documento padre."
}
],
"lastModified": "2026-06-16T23:07:49.163",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2AA3463B-FB1D-4957-A738-946399B1B9DB",
"versionEndIncluding": "4.0_beta"
},
{
"criteria": "cpe:2.3:a:apple:safari:0.8:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F5F96DD-BD44-497B-A05E-326819BC46F8"
},
{
"criteria": "cpe:2.3:a:apple:safari:0.9:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B00DC91-9895-405E-B9B4-211ABC3728DB"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.0:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82C4A098-7EAC-4611-B621-3F0EB1B15960"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.0.3:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56B016E7-C403-42AC-BF75-9BA723122A2F"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.1:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83CFAFD2-630E-4DB9-B187-6918CFE3075C"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.2:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F03B8DC9-B295-42A8-904F-3D1F827FFECD"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1876BC3B-B207-4E81-A0A7-259AFE6F2DEA"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3.1:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03BBCC9D-E160-4614-B2B8-6359FE644E02"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3.2:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDB6B46E-30E1-4E16-A941-F5E19AB34493"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E783789C-C5D4-47A2-A947-D19793B182E2"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0.2:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE3C68CF-21A2-47D8-84F2-FD3219E90043"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0.4:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D4AD962-D9AD-48E5-9B53-E3C1593D43CC"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30FA25DB-3525-4755-B038-6572B2457CF2"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.2:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9270F5C4-63B9-48C5-9D6D-9CDA1461205C"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.3:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BE1D829-A6C9-4B5C-971B-5515FB92061D"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.4:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BC133D1-E120-4B84-85DC-1D528CB77FAA"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90D8505E-35D2-40A1-9D75-1A023C4DD65E"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.1:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D087ECA-D214-4A6B-8F64-7F8AABB14706"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.2:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4ABDE92-E8A8-431D-BF9C-9A54667A8664"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.1:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94956778-7E73-4B42-B7B1-0D11837B8476"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.3:*:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC54BF41-2BF6-4604-AEFA-532453AB91E5"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1F650EC-4778-4233-9CF5-2B809CE4C799",
"versionEndIncluding": "3.2.3"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A588615E-EE35-4E19-8BDA-598ED9664686"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.1:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E61C168-482B-412A-97E8-B1C651797EDF"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.2:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32024B14-B4F7-466E-AEF2-0D3A7E8E1060"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.3:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D137F48A-E670-4BDB-B003-C6BB2A33F250"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.4:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85AB4EDB-408D-4D2F-95BE-B578455EFA4E"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B256D38-257B-4C3D-9EA5-2255BF3A329C"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.1:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "158AEA23-B5DB-4CBC-8391-2D97233A8E9A"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.2:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "218FBDC4-29AF-4BA1-A3FE-4E19B0E3E654"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77F31F4B-5305-4D75-9277-95EF99A969A9"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.1:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BDE11F09-3D57-4CF0-8165-90FB234CC403"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.2:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99118352-6845-4704-B4A3-F98E8C06E0FD"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}