CVE

Id
40448  
CVE No.
CVE-2009-3013  
Status
Candidate  
Description
Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP site.  
Phase
Assigned (20090831)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
444407 40448 CVE-2009-3013 MISC:http://websecurity.com.ua/3323/  View
444408 40448 CVE-2009-3013 MISC:http://websecurity.com.ua/3386/  View
444409 40448 CVE-2009-3013 XF:opera-data-xss(52996)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
43897 JVNDB-2009-004904 Orca Browser におけるクロスサイトスクリプティング (XSS) 攻撃を実行される脆弱性 Orca Browser は、HTTP レスポンスの Refresh および Location ヘッダの data: URI を適切にブロックしないため、クロスサイトスクリプティング (XSS) 攻撃を実行される脆弱性が存在します。 CVE-2009-3017 40448 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004904.html  View