Vulnerability · Published Dec 23, 2020 · Assigned by Opera
CVE-2020-6159
Medium 6.1
In plain English
A medium-severity cross-site scripting in Opera for Android. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.6%top 49.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Opera for Android | Below 61.0.3076.56532 |
Weakness: CWE-79