// For flags

CVE-2016-6908

 

Severity Score

6.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, due to mishandling of several unicode characters such as U+FE70, U+0622, U+0623 etc and how they are rendered combined with (first strong character) such as an IP address or alphabet could lead to a spoofed URL. It was noticed that by placing neutral characters such as "/", "?" in filepath causes the URL to be flipped and displayed from Right To Left. However, in order for the URL to be spoofed the URL must begin with an IP address followed by neutral characters as omnibox considers IP address to be combination of punctuation and numbers and since LTR (Left To Right) direction is not properly enforced, this causes the entire URL to be treated and rendered from RTL (Right To Left). However, it doesn't have be an IP address, what matters is that first strong character (generally, alphabetic character) in the URL must be an RTL character.

Caracteres de lenguas como el árabe o el hebreo se muestran en orden RTL (de derecha a izquierda) en Opera 37.0.2192.105088 para Android, debido al manejo incorrecto de muchos caracteres unicode como U+FE70, U+0622, U+0623 etc y cómo se representan combinadas (primer carácter fuerte) como una dirección IP o alfabeto podría conducir a una URL falsificada. Se ha advertido que poniendo caracteres neutrales como "/", "?" en la ruta de archivo provoca que la URL sea volteada y mostrada de derecha a izquierda. Sin embargo, para que la URL sea suplantada, debe comenzar con una dirección de IP seguida por caracteres neutrales ya que omnibox considera que la dirección IP es una combinación de puntuación y números y dado que la dirección LTR (izquierda a derecha) no es forzada adecuadamente, esto provoca que toda la URL sea tratada y representado desde RTL (derecha a izquierda). Sin embargo, no tiene que ser una dirección IP, lo que importa es que el primer carácter fuerte (generalmente, carácter alfabético) en la URL debe ser un carácter RTL.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-08-22 CVE Reserved
  • 2017-01-26 CVE Published
  • 2024-08-06 CVE Updated
  • 2024-11-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
References (1)
URL Tag Source
http://www.securityfocus.com/bid/92701 Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Opera
Search vendor "Opera"
Opera Browser
Search vendor "Opera" for product "Opera Browser"
37.0.2192.105088
Search vendor "Opera" for product "Opera Browser" and version "37.0.2192.105088"
android
Affected