Unscored severity · published Feb 5, 2009
CVE-2008-6059
xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which…
–
CVSS
1.9%
EPSS
No
On KEV
Description
xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webkit · Webkit
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6059
trac.webkit.org
http://trac.webkit.org/changeset/38566/trunk/WebCore/xml/XMLHttpRequest.cpp
www.securityfocus.com
http://www.securityfocus.com/bid/33804
bugs.webkit.org
https://bugs.webkit.org/show_bug.cgi?id=10957
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/48575
More from Webkit
8.8
CVE-2026-83596
Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
8.8
CVE-2026-78376
Webkitgtk: use-after-free of jscvalue function parameters
7.5
CVE-2016-9643
The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar)…
5.5
CVE-2016-9642
JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file
–
CVE-2010-1766
Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in Qt and other products,…