Vulnerability · NVD

CVE-2020-6159

CVE-2020-6159, medium severity (CVSS 6.1): 1 tracked app concerned, all fixed or indeterminable on their current version.

Severity (CVSS): 6.1
Exploitation: 0.6 %
Tracked apps: 1
Still exposed: 0

Published on 2020-12-23

URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS 0.64% exploit very unlikely percentile 48.5%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Opera Android com.opera.browser

Affected <61.0.3076.56532 Fixed in 61.0.3076.56532 Latest tracked 102.1.5206.90382 patched

Observed affected builds (6)

58.2.2878.53403 58.1.2878.53288 55.2.2719.50740 53.1.2569.142848 50.2.2426.136249 47.3.2249.130976

Vulnerable CPE configurations (1)

Vendor	Product	Platform	Versions	CPE 2.3 URI
opera	opera Android	Android	<61.0.3076.56532	cpe:2.3:a:opera:opera::::::android::*

View on NVD ↗ Advisory · security.opera.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM