What’s Vulnerable › Vulnerabilities

CVE-2009-3013

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2009-08-31 · updated 2026-06-16
• Weakness: CWE-79

Description

Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP site.

Affected products

• Opera Browser: through 9.52; 7.0, 7.23, 7.53, 7.54, 7.60, 8.0 (+17)

References

• http://websecurity.com.ua/3323/
• http://websecurity.com.ua/3386/
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52996
• http://websecurity.com.ua/3323/
• http://websecurity.com.ua/3386/
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52996

Get alerted when CVE-2009-3013 or the next vulnerability affects your stack