CVE-2018-6608

MEDIUM

Opera Browser - Information Disclosure

Title source: rule

Description

In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.

References (5)

[Third Party Advisory] https://docs.google.com/spreadsheets/d/1Nm7mxfFvmdn-3Az-BtE5O0BIdbJiIAWUnkoAF_v_0ug/edit?usp=sharing

[Third Party Advisory] https://github.com/VoidSec/WebRTC-Leak

View Writeup ZIP pw:eip

[Issue Tracking] https://news.ycombinator.com/item?id=16699270

[Third Party Advisory] https://voidsec.com/vpn-leak/

[Third Party Advisory] https://www.bleepingcomputer.com/news/security/many-vpn-providers-leak-customers-ip-address-via-webrtc-bug/

Scores

CVSS v3 4.3

EPSS 0.0052

EPSS Percentile 66.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (1)

opera/opera_browser

Timeline

Published Mar 28, 2018

Tracked Since Feb 18, 2026