CVE-2009-1724
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on...
CVE-2009-1724 is a medium vulnerability (CVSS 4.3) in Apple Iphone Os, published July 9, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.21%, the 93rd percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 6.21%EPSS, 93rd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WebKit - 'parent/top' Cross Domain Scripting | 2009-05-19 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
- Record
CVE-2009-1724- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
- Record
CVE-2009-1724- Updated
- 2026-11-02
EUVDEUVD-2009-1719No score
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
- Record
EUVD-2009-1719- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g6jx-986q-p3fmNo score
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on...
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
- Record
GHSA-g6jx-986q-p3fm- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
- Record
CVE-2009-1724- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/43068
support.apple.com/kb/HT3666
vupen.com/english/advisories/2011/0212
lists.apple.com/archives/security-announce/2009/Jul/msg00000.html
securityfocus.com/bid/35441
Show 10 moreShow less
osvdb.org/55738
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6208
lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
securitytracker.com/id?1022525
nvd.nist.gov/vuln/detail/CVE-2009-1724
github.com/advisories/GHSA-g6jx-986q-p3fm