CVE-2009-3048

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a "dropped file."

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.opera.com/docs/changelogs/freebsd/1000/Vendor Advisory
http://www.opera.com/docs/changelogs/linux/1000/Vendor Advisory
http://www.opera.com/docs/changelogs/solaris/1000/Vendor Advisory
http://www.opera.com/support/kb/view/931/Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5679
http://www.opera.com/docs/changelogs/freebsd/1000/Vendor Advisory
http://www.opera.com/docs/changelogs/linux/1000/Vendor Advisory
http://www.opera.com/docs/changelogs/solaris/1000/Vendor Advisory
http://www.opera.com/support/kb/view/931/Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5679

Timeline

Published: Sep 2, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-30495.0Opera before 10.00 does not properly display all characters in Internationalized Domain Names (IDN) in the address bar, which allows remote CVE-2009-305010.0Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitr CVE-2009-30517.5Multiple format string vulnerabilities in lib/silcclient/client_entry.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, a CVE-2009-30526.5SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote aut CVE-2009-30536.8Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbit CVE-2009-30547.5SQL injection vulnerability in the Artetics.com Art Portal (com_artportal) component 1.0 for Joomla! allows remote attackers to execute arbi CVE-2009-30557.5PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine (DLE) 8.2 allows remote attackers to execute arbitrar CVE-2009-30567.5PHP remote file inclusion vulnerability in include/engine/content/elements/menu.php in KingCMS 0.6.0 allows remote attackers to execute arbi CVE-2009-30574.3Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary web script or HTML via CVE-2009-30589.3Stack-based buffer overflow in akPlayer 1.9.0 allows remote attackers to execute arbitrary code via a long string in a .plt playlist file.CVE-2009-30597.5Multiple SQL injection vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to execute arbitrary SQL commands CVE-2009-30604.3Multiple cross-site scripting (XSS) vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to inject arbitrary w