CVE-2008-4199

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-09-27 · updated 2026-06-16
Weakness: CWE-200

Description

Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to determine the validity of local filenames via vectors involving "detection of JavaScript events and appropriate manipulation."

Affected products

Opera Browser: through 9.51; 5.0, 5.0-beta2, 5.0-beta3, 5.0-beta4, 5.0-beta5, 5.0-beta6 (+78)

References

http://bugs.gentoo.org/show_bug.cgi?id=235298
http://secunia.com/advisories/31549
http://secunia.com/advisories/32538
http://security.gentoo.org/glsa/glsa-200811-01.xml
http://securitytracker.com/id?1020722
http://www.openwall.com/lists/oss-security/2008/09/19/2
http://www.openwall.com/lists/oss-security/2008/09/24/4
http://www.opera.com/docs/changelogs/freebsd/952/
http://www.opera.com/docs/changelogs/linux/952/
http://www.opera.com/docs/changelogs/mac/952/
http://www.opera.com/docs/changelogs/solaris/952/
http://www.opera.com/docs/changelogs/windows/952/

Get alerted when CVE-2008-4199 or the next vulnerability affects your stack