CVE-2009-1703

CVE-2009-1703 describes a vulnerability in Apple Safari versions prior to 4.0, where its WebKit engine fails to restrict references to local file: URLs within audio and video HTML elements. This flaw allows a remote attacker to determine the existence of arbitrary files on a user's system by enticing them to visit a specially crafted HTML document. The vulnerability carries a CVSS score of 7.1 (High), indicating a significant risk. It is a network-based attack (AV:N) with medium attack complexity (AC:M) requiring no authentication (Au:N), and its primary impact is a complete loss of confidentiality (C:C) regarding file existence, with no integrity or availability impact. Despite its severity, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting it has not garnered significant attention.