Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
WebKit XMLHttpRequest Cookie 信息泄露漏洞
Vulnerability Description
WebKit r38566之前版本中的WebCore里的xml/XMLHttpRequest.cpp没有正确的限制从网页上对(1)Set-Cookie和(2)Set-Cookie2 HTTP响应头的访问，这使得远程攻击者可以借助XMLHttpRequest呼叫，从cookies中获得敏感信息。该漏洞与HTTPOnly保护机制有关。
CVSS Information
N/A
Vulnerability Type
N/A