Lucene search

MitreCVE-2009-3266

HistorySep 18, 2009 - 10:30 p.m.

CVE-2009-3266

2009-09-1822:30:00

CWE-79

mitre

web.nvd.nist.gov

opera

xss

cross-site scripting

cross-zone scripting

rss

atom feed

cve-2009-3266

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.005

Percentile

77.4%

JSON

Opera before 10.01 does not properly restrict HTML in a (1) RSS or (2) Atom feed, which allows remote attackers to conduct cross-site scripting (XSS) attacks, and conduct cross-zone scripting attacks involving the Feed Subscription Page to read feeds or create feed subscriptions, via a crafted feed, related to the rendering of the application/rss+xml content type as “scripted content.”

Affected configurations

Nvd

Node

operaopera_browserMatch5.0

operaopera_browserMatch5.0beta2

operaopera_browserMatch5.0beta3

operaopera_browserMatch5.0beta4

operaopera_browserMatch5.0beta5

operaopera_browserMatch5.0beta6

operaopera_browserMatch5.0beta7

operaopera_browserMatch5.0beta8

operaopera_browserMatch5.02

operaopera_browserMatch5.10

operaopera_browserMatch5.11

operaopera_browserMatch5.12

operaopera_browserMatch6.0

operaopera_browserMatch6.0beta1

operaopera_browserMatch6.0beta2

operaopera_browserMatch6.0tp1

operaopera_browserMatch6.0tp2

operaopera_browserMatch6.0tp3

operaopera_browserMatch6.1

operaopera_browserMatch6.01

operaopera_browserMatch6.1beta1

operaopera_browserMatch6.02

operaopera_browserMatch6.03

operaopera_browserMatch6.04

operaopera_browserMatch6.05

operaopera_browserMatch6.06

operaopera_browserMatch6.11

operaopera_browserMatch6.12

operaopera_browserMatch7.0

operaopera_browserMatch7.0beta1

operaopera_browserMatch7.0beta1_v2

operaopera_browserMatch7.0beta2

operaopera_browserMatch7.01

operaopera_browserMatch7.02

operaopera_browserMatch7.03

operaopera_browserMatch7.10

operaopera_browserMatch7.10beta1

operaopera_browserMatch7.11

operaopera_browserMatch7.11beta2

operaopera_browserMatch7.20

operaopera_browserMatch7.20beta7

operaopera_browserMatch7.21

operaopera_browserMatch7.22

operaopera_browserMatch7.23

operaopera_browserMatch7.50

operaopera_browserMatch7.50beta1

operaopera_browserMatch7.51

operaopera_browserMatch7.52

operaopera_browserMatch7.53

operaopera_browserMatch7.54

operaopera_browserMatch7.54update1

operaopera_browserMatch7.54update2

operaopera_browserMatch7.60

operaopera_browserMatch8.0

operaopera_browserMatch8.0beta1

operaopera_browserMatch8.0beta2

operaopera_browserMatch8.0beta3

operaopera_browserMatch8.01

operaopera_browserMatch8.02

operaopera_browserMatch8.50

operaopera_browserMatch8.51

operaopera_browserMatch8.52

operaopera_browserMatch8.53

operaopera_browserMatch8.54

operaopera_browserMatch9.0

operaopera_browserMatch9.0beta1

operaopera_browserMatch9.0beta2

operaopera_browserMatch9.01

operaopera_browserMatch9.02

operaopera_browserMatch9.10

operaopera_browserMatch9.12

operaopera_browserMatch9.20

operaopera_browserMatch9.20beta1

operaopera_browserMatch9.21

operaopera_browserMatch9.22

operaopera_browserMatch9.23

operaopera_browserMatch9.24

operaopera_browserMatch9.25

operaopera_browserMatch9.26

operaopera_browserMatch9.27

operaopera_browserMatch9.50

operaopera_browserMatch9.50beta1

operaopera_browserMatch9.50beta2

operaopera_browserMatch9.51

operaopera_browserMatch9.52

operaopera_browserMatch9.60

operaopera_browserMatch9.60beta1

operaopera_browserMatch9.61

operaopera_browserMatch9.62

operaopera_browserMatch9.63

operaopera_browserMatch9.64

operaopera_browserMatch10.00

operaopera_browserMatch10.00beta1

operaopera_browserMatch10.00beta2

operaopera_browserMatch10.00beta3

operaopera_browserMatch10.01

operaopera_browserMatch10.10

operaopera_browserMatch10.10beta1

operaopera_browserMatch10.50

operaopera_browserMatch10.50beta1

operaopera_browserMatch10.50beta2

operaopera_browserMatch10.51

operaopera_browserMatch10.52

operaopera_browserMatch10.53

operaopera_browserMatch10.53b

VendorProductVersionCPE
operaopera_browser6.0cpe:/a:opera:opera_browser:6.0:beta2::
operaopera_browser9.63cpe:/a:opera:opera_browser:9.63:::
operaopera_browser8.53cpe:/a:opera:opera_browser:8.53:::
operaopera_browser9.24cpe:/a:opera:opera_browser:9.24:::
operaopera_browser6.1cpe:/a:opera:opera_browser:6.1:beta1::
operaopera_browser9.20cpe:/a:opera:opera_browser:9.20:beta1::
operaopera_browser6.0cpe:/a:opera:opera_browser:6.0:tp1::
operaopera_browser6.05cpe:/a:opera:opera_browser:6.05:::
operaopera_browser5.12cpe:/a:opera:opera_browser:5.12:::
operaopera_browser8.0cpe:/a:opera:opera_browser:8.0:beta3::

Vendor	Product	Version	CPE
opera	opera_browser	6.0	cpe:/a:opera:opera_browser:6.0:beta2::
opera	opera_browser	9.63	cpe:/a:opera:opera_browser:9.63:::
opera	opera_browser	8.53	cpe:/a:opera:opera_browser:8.53:::
opera	opera_browser	9.24	cpe:/a:opera:opera_browser:9.24:::
opera	opera_browser	6.1	cpe:/a:opera:opera_browser:6.1:beta1::
opera	opera_browser	9.20	cpe:/a:opera:opera_browser:9.20:beta1::
opera	opera_browser	6.0	cpe:/a:opera:opera_browser:6.0:tp1::
opera	opera_browser	6.05	cpe:/a:opera:opera_browser:6.05:::
opera	opera_browser	5.12	cpe:/a:opera:opera_browser:5.12:::
opera	opera_browser	8.0	cpe:/a:opera:opera_browser:8.0:beta3::

Rows per page:

1-10 of 1051

References

archives.neohapsis.com/archives/bugtraq/2009-10/0289.html

secunia.com/advisories/37182

securethoughts.com/2009/09/exploiting-chrome-and-operas-inbuilt-atomrss-reader-with-script-execution-and-more/

securethoughts.com/2009/10/hijacking-operas-native-page-using-malicious-rss-payloads/

www.opera.com/docs/changelogs/mac/1001/

www.opera.com/docs/changelogs/unix/1001/

www.opera.com/docs/changelogs/windows/1001/

www.opera.com/support/kb/view/939/

www.osvdb.org/59358

www.securityfocus.com/archive/1/506517/100/0/threaded

www.securityfocus.com/bid/36418

www.securityfocus.com/bid/36850

www.vupen.com/english/advisories/2009/3073

exchange.xforce.ibmcloud.com/vulnerabilities/54021

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6314

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.005

Percentile

77.4%

JSON

Related for CVE-2009-3266