CVE-2008-6059 - CVE House
Back to Database
Status published Medium CVE-2008-6059

xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly...

Vulnerability Description

xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-6059

Credits & Attribution

No credits recorded in the NVD database.

References

More from webkit

View All →
CVE-2018-12294
WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version...
High 8.8
CVE-2016-9643
The regex code in Webkit 2.4.11 allows remote attackers to...
High 7.5
CVE-2016-9642
JavaScriptCore in WebKit allows attackers to cause a denial of...
Medium 5.5
CVE-2009-3933
WebKit before r50173, as used in Google Chrome before 3.0.195.32,...
Medium 5
CVE-2008-1590
JavaScriptCore in WebKit on Apple iPhone before 2.0 and iPod...
Medium 6.8

Affected Vendor

Affected Software

webkit
Vulnerable Versions:
Unknown

Timeline

Official Publish: February 5th, 2009
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.