Apple Webobjects vulnerabilities

3 CVEs affecting Apple Webobjects, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-37724, published 2022-09-14.

More from Apple.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2000-0299, published 2000-04-04. Medium severity, CVSS 5.0. EPSS: 5.2% chance of exploitation in the next 30 days. Buffer overflow in WebObjects.exe in the WebObjects Developer 4.5 package allows remote attackers to cause a denial of service via an HTTP request with long headers such as Accept.
• CVE-2011-3998, published 2011-11-09. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Apple WebObjects 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
• CVE-2022-37724, published 2022-09-14. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces.