VULNERABILITY INTELLIGENCE
CVE-2014-1296
CVSS score4.3 MEDIUM
EPSS probability1.88%
CISA KEVNot currently listed
Published2014-04-23
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N
Description
CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.