CVE-2009-3046
HIGH severity · CVSS 7.5 · CWE-295
7.5CVSS HIGH
Summary
Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactNone
Integrity impactHigh
Availability impactNone
Exploit probability (EPSS)1%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://www.opera.com/docs/changelogs/freebsd/1000/Advisory
- http://www.opera.com/docs/changelogs/linux/1000/Advisory
- http://www.opera.com/docs/changelogs/mac/1000/Advisory
- http://www.opera.com/docs/changelogs/solaris/1000/Advisory
- http://www.opera.com/docs/changelogs/windows/1000/Advisory
- http://www.opera.com/support/kb/view/929/Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6357