CVE-2009-2059

Опубликовано: 15 июн. 2009

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:opera:opera_browser:*:*:*:*:*:*:*:*

Версия до 9.22 (включая)

cpe:2.3:a:opera:opera_browser:7.0:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:7.23:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:7.53:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:7.54:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:7.60:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:8.0:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:8.01:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:8.02:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:8.50:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:8.51:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:8.52:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:8.53:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:8.54:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:9.0:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:9.01:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:9.02:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:9.10:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:9.12:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:9.20:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:9.21:*:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.00235

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-58hv-2vjm-27h5

github

почти 4 года назад