{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40451", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2023-08-14T20:26:36.268Z", "datePublished": "2023-09-26T20:14:38.617Z", "dateUpdated": "2025-02-13T17:08:21.083Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An attacker with JavaScript execution may be able to execute arbitrary code"}]}], "affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "17", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution may be able to execute arbitrary code."}], "references": [{"url": "https://support.apple.com/en-us/HT213941"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/28/3"}, {"url": "http://seclists.org/fulldisclosure/2023/Oct/2"}, {"url": "https://security.gentoo.org/glsa/202401-33"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2024-01-31T15:06:38.133Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-29T13:17:26.800Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.apple.com/en-us/HT213941", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/28/3", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Oct/2", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202401-33", "tags": ["x_transferred"]}, {"url": "https://webkitgtk.org/security/WSA-2023-0009.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-02-01T19:54:23.789025Z", "id": "CVE-2023-40451", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-20T18:34:05.685Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.apple.com/en-us/HT213941", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/28/3", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Oct/2", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202401-33", "tags": ["x_transferred"]}, {"url": "https://webkitgtk.org/security/WSA-2023-0009.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-29T13:17:26.800Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-40451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-01T19:54:23.789025Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-20T18:34:02.510Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/HT213941"}, {"url": "http://www.openwall.com/lists/oss-security/2023/09/28/3"}, {"url": "http://seclists.org/fulldisclosure/2023/Oct/2"}, {"url": "https://security.gentoo.org/glsa/202401-33"}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution may be able to execute arbitrary code."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An attacker with JavaScript execution may be able to execute arbitrary code"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2024-01-31T15:06:38.133Z"}}}, "cveMetadata": {"cveId": "CVE-2023-40451", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:08:21.083Z", "dateReserved": "2023-08-14T20:26:36.268Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2023-09-26T20:14:38.617Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "93FB6D0F-A668-47CF-A63D-755CA3BA259A", "versionEndExcluding": "17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution may be able to execute arbitrary code."}, {"lang": "es", "value": "Este problema se solucion\u00f3 mejorando la aplicaci\u00f3n de la sandbox de iframe. Este problema se solucion\u00f3 en Safari 17. Un atacante con ejecuci\u00f3n de JavaScript puede ejecutar c\u00f3digo arbitrario."}], "id": "CVE-2023-40451", "lastModified": "2024-11-21T08:19:29.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-27T15:19:17.090", "references": [{"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Oct/2"}, {"source": "product-security@apple.com", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2023/09/28/3"}, {"source": "product-security@apple.com", "url": "https://security.gentoo.org/glsa/202401-33"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT213941"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Oct/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2023/09/28/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202401-33"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT213941"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://webkitgtk.org/security/WSA-2023-0009.html"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:7055", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "webkit2gtk3-0:2.40.5-1.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-11-14T00:00:00Z"}, {"advisory": "RHSA-2023:6535", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "webkit2gtk3-0:2.40.5-1.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}], "bugzilla": {"description": "webkitgtk: attacker with JavaScript execution may be able to execute arbitrary code", "id": "2241409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241409"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "details": ["This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution may be able to execute arbitrary code.", "A flaw was found in WebKitGTK. An attacker may be able to execute JavaScript code to trigger Remote Code Execution, resulting in a high impact on data confidentiality, integrity, and system availability."], "name": "CVE-2023-40451", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "webkitgtk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "webkitgtk4", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2023-09-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-40451\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-40451\nhttps://webkitgtk.org/security/WSA-2023-0009.html"], "threat_severity": "Moderate"}