PT-2019-20234 · Unknown · Smartbanner.Js

Published 2019-09-13 · Updated 2025-02-18 · CVE-2025-25300

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:U

Name of the Vulnerable Software and Affected Versions smartbanner.js versions prior to 1.14.1

Description The issue concerns a Cross-Origin Window Reference Vulnerability. When a user clicks on the View link in the smartbanner and navigates to a third-party page, it leaves the window.opener exposed. This exposure may allow hostile third parties to abuse the window.opener by redirection or injection on the original page with the smartbanner. To resolve this, rel="noopener" is automatically added to links as of version 1.14.1, which is a recommended upgrade. For those who cannot upgrade, ensuring the View link only takes users to the App Store or Google Play Store, where security is managed by the respective app store security teams, can mitigate the issue. Alternatively, limiting the use of smartbanner.js to iOS decreases the scope of the vulnerability, as Safari 12.1 and later impose rel="noopener" on all target=" blank" links.

Recommendations For versions prior to 1.14.1, upgrade to version 1.14.1 to resolve the vulnerability. As a temporary workaround, consider ensuring the View link is only used to direct users to the App Store or Google Play Store. If the View link must be used to direct users to a third-party page, limit the use of smartbanner.js to iOS to decrease the vulnerability's scope. Consider using the smartbanner meta tags to limit the use of smartbanner.js on specific platforms, such as setting <meta name="smartbanner:enabled-platforms" content="none"> and <meta name="smartbanner:include-user-agent-regex" content="Mobile.*Safari"> to only allow its use on Safari for iOS.

Exploit

Fix

Open Redirect

XSS

Weakness Enumeration

CWE-601

CWE-79

Related Identifiers

CVE-2025-25300

GHSA-9MRQ-CJGH-32G2

Affected Products

Smartbanner.Js

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25300.json · Exploit
• https://osv.dev/vulnerability/GHSA-9mrq-cjgh-32g2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25300 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25300 · Vendor Advisory
• https://github.com/ain/smartbanner.js/commit/fce8c31dfe04033d9d005a89694d3e7a60784f89 · Note
• https://github.com/ain/smartbanner.js/security/advisories/GHSA-9mrq-cjgh-32g2 · Note
• https://github.com/ain/smartbanner.js · Note
• https://twitter.com/CVEnew/status/1891908145439481947 · Twitter Post
• https://t.me/cvedetector/18349 · Telegram Post
• https://github.com/advisories/GHSA-9mrq-cjgh-32g2 · Note
• https://twitter.com/VulmonFeeds/status/1891939133049778239 · Twitter Post