GHSA-qm5v-pj64-852j

GHSA-qm5v-pj64-852j · Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

### Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. ### Impact of issue The newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data. ### Fix The code that opens a new window via window.open(); now open the tab with the noopener attribute.

CVSS 5.5 · Moyenne · Correctif disponible

Publication

2024-05-20T17:09:57Z

Mise à jour

2024-12-05T05:36:29.026187Z

Pile logicielle: php

Vérifiez votre serveur →