Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.8

Opera allows injected scripts via mixed-content pages

CVE-2009-2068 · published 17 years ago
Summary

Opera may load insecure content on secure sites when the main page uses HTTPS but includes an HTTP iframe. An attacker who can alter the HTTP page can insert malicious script that runs as if it came from the secure site. Update Opera to the latest version or apply the vendor's recommended patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
opera opera 5..10
5.0
5.1
5.02
5.2
5.3
5.4
5.5
5.6
5.7
5.8
5.9
42 more version ranges
cpe:2.3:a:opera:opera:5..10:*:*:*:*:*:*:*
Original advisory text
Google Chrome detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context,...
Google Chrome detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.8 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published15 Jun 2009
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-2068 · NVD
Track software like this
Free during beta