CVE-2020-6159

CVSS V2 Medium 4.3 CVSS V3 Medium 6.1
Description
URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.
Overview
  • CVE ID
  • CVE-2020-6159
  • Assigner
  • security@opera.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2020-12-23T16:15:13
  • Last Modified Date
  • 2020-12-23T19:27:17
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:opera:opera:*:*:*:*:*:android:*:* 1 OR 61.0.3076.56532
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • REQUIRED
  • Scope
  • CHANGED
  • Confidentiality Impact
  • LOW
  • Availability Impact
  • NONE
  • Base Score
  • 6.1
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 2.8
  • Impact Score
  • 2.7
References
Reference URL Reference Tags
https://security.opera.com/cross-site-scripting-in-ofa-opera-security-advisories/ Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2020-6159
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6159
History
Created Old Value New Value Data Type Notes
2022-05-10 07:29:28 Added to TrackCVE
2022-12-05 18:44:22 2020-12-23T16:15Z 2020-12-23T16:15:13 CVE Published Date updated
2022-12-05 18:44:22 2020-12-23T19:27:17 CVE Modified Date updated
2022-12-05 18:44:22 Analyzed Vulnerability Status updated