VulnerabilityModified
CVE-2010-2661
Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict access to the full pathname of a file selected for upload, which allows remote attackers to obtain potentially sensitive information via…
MEDIUM 4.3EPSS 2.27%
Does this matter?
Lower severity and a low EPSS score (2.27%). Track it; it rarely justifies an emergency change on its own.
Description
Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict access to the full pathname of a file selected for upload, which allows remote attackers to obtain potentially sensitive information via unspecified DOM manipulations.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 2.27% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- opera/opera browser
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/40250Vendor Advisory
- http://www.opera.com/docs/changelogs/mac/1054/
- http://www.opera.com/docs/changelogs/unix/1060/
- http://www.opera.com/docs/changelogs/windows/1054/
- http://www.opera.com/support/search/view/960/Vendor Advisory
- http://www.securityfocus.com/bid/40973
- http://www.vupen.com/english/advisories/2010/1529Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1673Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11669
- http://secunia.com/advisories/40250Vendor Advisory
- http://www.opera.com/docs/changelogs/mac/1054/
- http://www.opera.com/docs/changelogs/unix/1060/
- http://www.opera.com/docs/changelogs/windows/1054/
- http://www.opera.com/support/search/view/960/Vendor Advisory
- http://www.securityfocus.com/bid/40973
- http://www.vupen.com/english/advisories/2010/1529Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1673Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11669
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.