CSRF in Opera Browser
CVE-2013-1639
Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection mechanism via a crafted web site that triggers a CORS request.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.005 (39.4th percentile) — read the EPSS interpretation.
Affected products
- Opera Opera_browser — versions 12.00, 12.01, 12.02
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)