CVE-2014-1257

low

Published 2014-02-27 · Modified 2026-04-29

CVSS v3

—

CVSS v2

3.6

VIR risk

3.6

Description

CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: product-security@apple.com — http://support.apple.com/kb/HT6150

OS impact

OS	Version	Status
macos		affected
macos	10.8.0	affected
macos	10.8.1	affected
macos	10.8.2	affected
macos	10.8.3	affected
macos	10.8.4	affected
macos	10.8.5	affected

References

http://support.apple.com/kb/HT6150
http://support.apple.com/kb/HT6150

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.