Opera before 11.60 does not properly consider the number of . (dot) characters that conventionally exist in domain names of different top-level domains, which allows remote attackers to bypass the Same Origin Policy by leveraging access to a different domain name in the same top-level domain, as demonstrated by the .no or .uk domain.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade operaUpgrade opera-develUpgrade linux-opera | Dec 10, 2025 | Dec 13, 2011 |
| Gentoo Linux | — | Upgrade www-client/opera. | Oct 30, 2017 | Dec 7, 2011 |
| Suse | — | Upgrade operaUpgrade opera-gtkUpgrade opera-kde4 | Dec 12, 2013 | Dec 7, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub