CVE-2020-6159: XSS
First published: Wed Dec 23 2020(Updated: )
URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.
Credit: security@opera.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opera Opera | <61.0.3076.56532 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2020-6159?
CVE-2020-6159 refers to a vulnerability where the protocol of URLs using 'javascript:' is not removed when pasted into the address bar, potentially exposing users to cross-site scripting (XSS) attacks.
What is the severity of CVE-2020-6159?
The severity of CVE-2020-6159 is medium with a CVSS score of 6.1.
How does CVE-2020-6159 affect Opera on Android?
CVE-2020-6159 affects Opera on Android versions up to exclusive version 61.0.3076.56532.
How can the CVE-2020-6159 vulnerability be exploited?
The CVE-2020-6159 vulnerability can be exploited by tricking users into running a cross-site scripting (XSS) attack on themselves through social engineering techniques.
Is there a fix available for CVE-2020-6159?
It is recommended to update Opera on Android to a version above 61.0.3076.56532 to fix the CVE-2020-6159 vulnerability.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/opera
- canonical/opera opera