vulnwire
2.6low

CVE-2004-24911 exploit

A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded, which allows…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
2.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.3%
percentile 94%
Public exploits
1
Exploit-DB

A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded, which allows remote attackers to spoof the URL in the address bar via the window.open and location.replace HTML parameters, which facilitates phishing attacks.

Exploit prediction (EPSS)

6.32% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

  • EDB-24325 Opera Web Browser 7.53 - Location Replace URI Obfuscation · remote · 2004-07-27

CVSS scores

Assigned byVersionScoreVector
NVD2.02.6AV:N/AC:H/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

  • exchange.xforce.ibmcloud.com /vulnerabilities/16816 · vdb-entry, x_refsource_XF, x_transferred
  • archives.neohapsis.com /archives/fulldisclosure/2004-07/1056.html · mailing-list, x_refsource_FULLDISC, x_transferred
  • secunia.com /advisories/12162 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • opera.com /windows/changelogs/754/ · x_refsource_CONFIRM, x_transferred
  • osvdb.org /8317 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/10810 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.