Vulnerability Name:

CVE-2004-1490 (CCN-18423)

Assigned:2004-12-10
Published:2004-12-10
Updated:2022-02-28
Summary:Opera 7.54 and earlier allows remote attackers to spoof file types in the download dialog via dots and non-breaking spaces (ASCII character code 160) in the (1) Content-Disposition or (2) Content-Type headers.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:2.6 Low (CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2004-1490

Source: CCN
Type: SA12981
Opera Download Dialog Spoofing Vulnerability

Source: SECUNIA
Type: Broken Link, Patch
12981

Source: MISC
Type: Broken Link, Patch
http://secunia.com/secunia_research/2004-19/advisory/

Source: CCN
Type: GLSA-200502-17
Opera: Multiple vulnerabilities

Source: GENTOO
Type: Patch, Third Party Advisory
GLSA-200502-17

Source: CCN
Type: Opera Download Web page
Download Opera Web browser

Source: CONFIRM
Type: Broken Link
http://www.opera.com/linux/changelogs/754u1/

Source: CCN
Type: OSVDB ID: 12291
Opera Download File Type Dialog Spoofing

Source: BID
Type: Broken Link, Patch, Third Party Advisory, VDB Entry
11883

Source: CCN
Type: BID-11883
Opera Web Browser Download Dialogue Box File Name Spoofing Vulnerability

Source: XF
Type: Third Party Advisory, VDB Entry
opera-file-type-spoofing(18423)

Source: XF
Type: UNKNOWN
opera-file-type-spoofing(18423)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:opera:opera_browser:*:*:*:*:*:*:*:* (Version <= 7.54)

    • Configuration CCN 1:
  • cpe:/a:opera:opera_browser:7.54:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    opera opera browser *
    opera opera browser 7.54
    gentoo linux *