The XMLHttpRequest object in Opera 8.0 Final Build 1095 allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains via a redirect.

A Secunia Advisory reports :

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to steal content or to perform actions on other websites with the privileges of the user.

Normally, it should not be possible for the XMLHttpRequest object to access resources from outside the domain of which the object was opened. However, due to insufficient validation of server side redirects, it is possible to circumvent this restriction.

The remote host is using a version of Opera that is prone to a security flaw where a malicious attacker can inject malicious data into a URI.  Such an attack would require that the attacker be able to convince an Opera user to browse to a malicious URI.  Successful exploitation would result in the attacker gaining access to confidential data (such as authentication cookies) or executing code within the browser.  

The version of Opera installed on the remote host is earlier than 8.01 and thus reportedly affected by multiple issues :

  - It may be possible for a malicious website to spoof     dialog boxes.

  - It may be possible for a XMLHttpRequest object to gain     unauthorized access to sensitive data.

  - The installed version is affected by multiple cross-site     scripting vulnerabilities.

  - When using the GET form, file path information could be     disclosed.

The remote host is using a version of Opera that is prone to a security flaw where a malicious attacker can inject malicious data into a URI.  Such an attack would require that the attacker be able to convince an Opera user to browse to a malicious URI.  Successful exploitation would result in the attacker gaining access to confidential data (such as authentication cookies) or executing code within the browser.

ID	Name	Product	Family	Severity
18991	FreeBSD : opera -- XMLHttpRequest security bypass (79217c9b-e1d9-11d9-b875-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
3015	Opera Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
18503	Opera < 8.01 Multiple Vulnerabilities	Nessus	Windows	medium
800832	Opera Multiple Injection Vulnerabilities	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2005-1475

medium

Tenable Plugins

high

medium

medium

medium