CVE-2018-6608

Published: Mar 28, 2018Modified: Jun 17, 2026

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.

Affected (1)

Products: Opera: Opera Browser

Opera

1 product

Opera Browser

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Opera Opera Browser	Version 51.0.2830.55

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

https://docs.google.com/spreadsheets/d/1Nm7mxfFvmdn-3Az-BtE5O0BIdbJiIAWUnkoAF_v_0ug/edit?usp=sharing

Source: cve@mitre.org

Third Party Advisory

https://github.com/VoidSec/WebRTC-Leak

Source: cve@mitre.org

Third Party Advisory

https://news.ycombinator.com/item?id=16699270

Source: cve@mitre.org

Issue Tracking

https://voidsec.com/vpn-leak/

Source: cve@mitre.org

Third Party Advisory

https://www.bleepingcomputer.com/news/security/many-vpn-providers-leak-customers-ip-address-via-webrtc-bug/

Source: cve@mitre.org

Third Party Advisory

https://docs.google.com/spreadsheets/d/1Nm7mxfFvmdn-3Az-BtE5O0BIdbJiIAWUnkoAF_v_0ug/edit?usp=sharing