GHSA-qm5v-pj64-852j

GHSA-qm5v-pj64-852j · Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

### Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. ### Impact of issue The newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data. ### Fix The code that opens a new window via window.open(); now open the tab with the noopener attribute.

CVSS 5.5 · Media · Corrección disponible

Publicación

2024-05-20T17:09:57Z

Actualización

2024-12-05T05:36:29.026187Z

Pila tecnológica: php

Comprueba tu servidor →