CVE-2009-1691
Status: ModifiedMedium (4.3)—
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to insufficient access control for standard JavaScript prototypes in other domains.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Base score: 4.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.66%
- Percentile among all scored CVEs: 85
- Score date: 10/9/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-79
References
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://osvdb.org/54989
- http://secunia.com/advisories/35379
- http://secunia.com/advisories/43068
- http://securitytracker.com/id?1022344
- http://support.apple.com/kb/HT3613
- http://support.apple.com/kb/HT3639
- http://www.securityfocus.com/bid/35260
- http://www.securityfocus.com/bid/35330
- http://www.vupen.com/english/advisories/2009/1522
- http://www.vupen.com/english/advisories/2009/1621
- http://www.vupen.com/english/advisories/2011/0212
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://osvdb.org/54989
- http://secunia.com/advisories/35379
- http://secunia.com/advisories/43068
- http://securitytracker.com/id?1022344
- http://support.apple.com/kb/HT3613
- http://support.apple.com/kb/HT3639
- http://www.securityfocus.com/bid/35260
- http://www.securityfocus.com/bid/35330
- http://www.vupen.com/english/advisories/2009/1522
- http://www.vupen.com/english/advisories/2009/1621
- http://www.vupen.com/english/advisories/2011/0212
Raw JSON (NVD)
Show
{
"id": "CVE-2009-1691",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-06-10T14:30:00.453",
"references": [
{
"url": "http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html",
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/54989",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/35379",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/43068",
"source": "cve@mitre.org"
},
{
"url": "http://securitytracker.com/id?1022344",
"source": "cve@mitre.org"
},
{
"url": "http://support.apple.com/kb/HT3613",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://support.apple.com/kb/HT3639",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/35260",
"tags": [
"Exploit",
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/35330",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1522",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1621",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2011/0212",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/54989",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/35379",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/43068",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securitytracker.com/id?1022344",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://support.apple.com/kb/HT3613",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://support.apple.com/kb/HT3639",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/35260",
"tags": [
"Exploit",
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/35330",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1522",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1621",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2011/0212",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to insufficient access control for standard JavaScript prototypes in other domains."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebKit en Apple Safari anterior a v4.0 permite a atacantes remotos inyectar secuencias de comandos web a su elección o HTML a través de vectores relacionados con el control insuficiente de acceso a los prototipos estándar de JavaScript en otros dominios."
}
],
"lastModified": "2026-06-16T23:07:50.240",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D72FE38B-BD04-4FC7-AE41-6459CBDF207A",
"versionEndIncluding": "4.0_beta"
},
{
"criteria": "cpe:2.3:a:apple:safari:0.8:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F7275FE-C28A-4067-B9EF-BC99E10188DA"
},
{
"criteria": "cpe:2.3:a:apple:safari:0.9:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2249206-EF91-4168-B7C2-C1DB35CDFA40"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.0:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "641D655F-E210-4795-836C-BBF6D90B92E9"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.0.3:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6EED222-BF5E-475A-B255-18041B4A5B26"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.1:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FC456E7-727C-4932-A0D0-B0D168E8C523"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.2:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "303E4616-1BB6-4D2D-8437-47F3D1B3C13D"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03C2A522-2D71-4909-B86F-DBEE2C703F83"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3.1:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E75B3EAD-A9D3-4497-B3B0-E31E807010A4"
},
{
"criteria": "cpe:2.3:a:apple:safari:1.3.2:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F837BE0E-9255-41C5-8E49-57090A574A9C"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8870C90-A1C9-4D8C-B1EF-9D72D55535EE"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0.2:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "586ED537-9BB4-4931-8891-E60740983C4A"
},
{
"criteria": "cpe:2.3:a:apple:safari:2.0.4:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73B23547-9710-44E9-A32A-6320C8E7A780"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EBFEED2C-8822-44EB-9296-82862DB14DCE"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.2:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9270F5C4-63B9-48C5-9D6D-9CDA1461205C"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.3:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD35EC3D-01E2-4FA7-95AC-A2E57C652649"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.4:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C23C022E-293E-4247-A9AD-2F27C29E92A4"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "75359A0E-823A-45C5-8C61-ABE225FB939F"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.1:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CFED254-6277-4E5E-B8E7-B5CB1ED3E7FA"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.2:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F8283078-D722-40AC-AF7A-7BC9AD19D051"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.1:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "66132AA6-F3EA-408D-9C43-8E6C577C8F72"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.3:-:mac:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8CFE8E7-B970-4B86-99E9-AC3F8626737C"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E203D81-FABE-4A63-8930-1DA15A86E113",
"versionEndIncluding": "3.2.3"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49875E29-AA30-4D96-9ED9-538823DD5E1C"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.1:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D6C733F3-F5D4-4CF1-866D-61FF9D81D1B3"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.2:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5471735-D9C0-491B-9A6A-07B39AA215CF"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.3:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E5C52F3-2109-40FD-9945-A9A9D42C076E"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.4:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "151DEB6D-5857-4B0B-8449-5735768024A5"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC7E7F65-8F3B-42F8-8B2D-9EA1CC4A4300"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.1:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "476EBE1F-66E1-4EF5-8344-BEDA97F306A4"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.2:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "480ED2AC-0DA4-44DA-A902-8534335077B9"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77F31F4B-5305-4D75-9277-95EF99A969A9"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.1:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9AD216D-0C95-4843-A1A1-C3C9A6219277"
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.2:-:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04B8652D-BE06-49CB-A636-8B53B2DF9168"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}