GHSA-qm5v-pj64-852j

GHSA-qm5v-pj64-852j · Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

### Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. ### Impact of issue The newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data. ### Fix The code that opens a new window via window.open(); now open the tab with the noopener attribute.

CVSS 5.5 · Mittel · Korrektur verfügbar

Veröffentlicht

2024-05-20T17:09:57Z

Aktualisiert

2024-12-05T05:36:29.026187Z

Technologie-Stack: php

Prüfen Sie Ihren Server →