CVE-2009-3013
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
31/08/2009
Last modified:
09/04/2025
Description
Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP site.
Impact
Base Score 2.0
4.30
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:opera:opera_browser:*:*:*:*:*:*:*:* | 9.52 (including) | |
| cpe:2.3:a:opera:opera_browser:7.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:7.23:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:7.53:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:7.54:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:7.60:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:8.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:8.01:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:8.02:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:8.50:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:8.51:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:8.52:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:8.53:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:8.54:*:*:*:*:*:*:* | ||
| cpe:2.3:a:opera:opera_browser:9.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page