製品・ソフトウェアに関する情報
Vulnerability Search
Opera における data: URI をブロックしない脆弱性
Title Opera における data: URI をブロックしない脆弱性
Summary

Opera には、HTTP レスポンス内の Location ヘッダにある data: URI を適切にブロックしないため、クロスサイトスクリプティング攻撃をされる脆弱性が存在します。

Possible impacts 第三者により、クロスサイトスクリプティング攻撃をされる可能性があります。
Solution

ベンダ情報及び参考情報を参照して適切な対策を実施してください。
Publication Date Aug. 31, 2009, midnight
Registration Date Sept. 27, 2010, 4:13 p.m.
Last Update Sept. 27, 2010, 4:13 p.m.
CVSS2.0 : 警告
Score 4.3
Vector AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected System
Opera Software ASA
Opera 10.00 Beta 3 Build 1699
Opera 9.52 およびそれ以前
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
No Changed Details Date of change
0 [2010年09月27日]
  掲載		 Feb. 17, 2018, 10:37 a.m.
NVD Vulnerability Information
CVE-2009-3013
Summary

Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP site.

Publication Date Sept. 1, 2009, 1:30 a.m.
Registration Date Jan. 29, 2021, 1:22 p.m.
Last Update Oct. 31, 2018, 1:26 a.m.
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:opera:opera_browser:7.0:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:7.23:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:7.53:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:7.54:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:7.60:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:8.0:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:8.01:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:8.02:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:8.50:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:8.51:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:8.52:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:8.53:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:8.54:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.0:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.01:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.02:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.10:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.12:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.20:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.21:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.22:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:9.51:*:*:*:*:*:*:*
cpe:2.3:a:opera:opera_browser:*:*:*:*:*:*:*:* 9.52
cpe:2.3:a:opera:opera_browser:10.00:beta_3:*:*:*:*:*:*
Related information, measures and tools
Common Vulnerabilities List