CVE-2007-1115

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-26 · updated 2026-06-16
Weakness: CWE-79

Description

The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.

Affected products

Opera Browser: 9.0, 9.0-beta1, 9.0-beta2, 9.01, 9.02, 9.10 (+3)

References

http://osvdb.org/32118
http://secunia.com/advisories/24312
http://secunia.com/advisories/25027
http://www.hardened-php.net/advisory_032007.142.html
http://www.novell.com/linux/security/advisories/2007_28_opera.html
http://www.opera.com/support/search/view/855/
http://www.securityfocus.com/archive/1/461076/100/0/threaded
http://www.securityfocus.com/bid/22701
http://www.securitytracker.com/id?1017909
http://www.vupen.com/english/advisories/2007/0745
http://osvdb.org/32118
http://secunia.com/advisories/24312

Get alerted when CVE-2007-1115 or the next vulnerability affects your stack