CVE-2007-2401

no score yetEPSS 7.1%

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function. NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.

EPSS: 7.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2007-06-25
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

apple:mac_os_x
apple:mac_os_x_server

References

http://docs.info.apple.com/article.html?artnum=305759
http://docs.info.apple.com/article.html?artnum=306173
http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html
http://osvdb.org/36449
http://secunia.com/advisories/25786

Check your stack JSON