Search the knowledgebase


Advisory: Malicious setRequestHeader cross-site vulnerability

Summary

A malicious setRequestHeader can be used to steal user credentials and inject cross-site JavaScript.

Severity: high

Opera's response

Since version 8.02 of Opera, double newlines or a single newline not followed by a space are removed. Users with a version older than 8.02 should upgrade to the most recent version of Opera.

Credits

Thanks to Yutaka OIWA for reporting this issue.

Browse through articles in the same categories: advisory