CVE:CVE-2009-2351
CNNVD:CNNVD-200907-099
Opera 9.52以及之前版本不阻拦HTTP响应的Refresh页眉中的javascript:URIs。远程攻击者可以借助与注入刷新页眉 (injecting a Refresh header)相关的向量或与指定刷新页眉的内容(specifying the content of a Refresh header)相关的向量执行跨站脚本攻击。
solution:Upgrade opera opera_browser to a higher version than 9.52,7.0,7.23,7.53,7.54,7.60,8.0,8.01,8.02,8.50,8.51,8.52,8.53,8.54,9.0,9.01,9.02,9.10,9.12,9.20,9.21,9.22,9.51,10.00:beta_3,and avoid the version (,9.52],7.0,7.23,7.53,7.54,7.60,8.0,8.01,8.02,8.50,8.51,8.52,8.53,8.54,9.0,9.01,9.02,9.10,9.12,9.20,9.21,9.22,9.51,10.00:beta_3