CVE-2009-2063
Opera < 9.25 - Man-in-the-Middle Script Execution via 3xx CONNECT Response
Title source: llmDescription
Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_misc
http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/35412
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/51204
Vendor Advisory x_refsource_misc
http://research.microsoft.com/apps/pubs/default.aspx?id=79323
Scores
EPSS
0.0027
EPSS Percentile
50.3%
Details
CWE
CWE-287
Status
published
Products (27)
opera/opera_browser
1.00
opera/opera_browser
2.00
opera/opera_browser
2.10 (4 CPE variants)
opera/opera_browser
2.12
opera/opera_browser
3.00 (2 CPE variants)
opera/opera_browser
3.10
opera/opera_browser
3.21
opera/opera_browser
3.50
opera/opera_browser
3.51
opera/opera_browser
3.60
... and 17 more
Published
Jun 15, 2009
Tracked Since
Feb 18, 2026