Unrated severityNVD Advisory· Published Apr 28, 2008· Updated Jun 16, 2026

CVE-2008-1999

Description

Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of the authority component of the URL (aka the user field), as demonstrated by %E3%80%80 sequences.

Affected products

Apple Inc./Safari2 versions
cpe:2.3:a:apple:safari:3.1.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apple:safari:3.1.1:*:*:*:*:*:*:*
- (no CPE)range: 3.1.1

Patches

Vulnerability mechanics

References

secunia.com/advisories/29900nvdVendor Advisory
es.geocities.com/jplopezy/pruebasafari3.htmlnvd
securityreason.com/securityalert/3833nvd
www.securityfocus.com/archive/1/491192/100/0/threadednvd
www.vupen.com/english/advisories/2008/1347nvd
exchange.xforce.ibmcloud.com/vulnerabilities/41981nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000