GHSA-qm5v-pj64-852j

GHSA-qm5v-pj64-852j · Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

This page contains facts from public vulnerability sources. Check the original advisory before updating.

### Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. ### Impact of issue The newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data. ### Fix The code that opens a new window via window.open(); now open the tab with the noopener attribute.

CVSS 5.5 · Medium · Fix available

Published

2024-05-20T17:09:57Z

Updated

2024-12-05T05:36:29.026187Z

Stack: php

Check your server →