| Vulnerability Name: | CVE-2009-3265 (CCN-53605) | ||||||||||||
| Assigned: | 2009-09-15 | ||||||||||||
| Published: | 2009-09-15 | ||||||||||||
| Updated: | 2018-10-10 | ||||||||||||
| Summary: | Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." Note: the vendor reportedly considers this behavior a "design feature," not a vulnerability. | ||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.1 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)
4.1 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)
| ||||||||||||
| Vulnerability Type: | CWE-79 | ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2009-3265 Source: CCN Type: SecureThoughts Web Site Exploiting Chrome and Operas inbuilt ATOM/RSS reader with Script Execution and more Source: MISC Type: UNKNOWN http://securethoughts.com/2009/09/exploiting-chrome-and-operas-inbuilt-atomrss-reader-with-script-execution-and-more/ Source: CCN Type: OSVDB ID: 58258 Opera RSS / Atom Feed application/rss+xml Content XSS Source: BUGTRAQ Type: UNKNOWN 20090916 Exploiting Chrome and Opera's inbuilt ATOM/RSS reader with Script Execution and more Source: XF Type: UNKNOWN opera-rss-atom-xss(53605) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:6370 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||