CVE-2014-1296: CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the…

Unscored severity · published Apr 23, 2014

CVE-2014-1296

CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the…

–

CVSS

1.9%

EPSS

On KEV

Description

CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.9% · higher than 79% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

iOS · Apple

through 7.1; 7.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +2 more · source: NVD

Mac OS X · Apple

10.8.0; 10.8.1; 10.8.2; 10.8.3; 10.8.4; 10.8.5; +10 more · source: NVD