PT-2020-18287 · Joomla · Wp-Businessdirectory

Published 2020-02-03 · Updated 2021-07-21 · CVE-2020-5182

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions J-BusinessDirectory extension versions prior to 5.2.9 for Joomla!

Description The issue allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" (or similar attributes such as noreferrer), the tabnabbing may occur. To reproduce the bug, create a business with a website link that contains JavaScript to exploit the window.opener property (for example, by setting window.opener.location).

Recommendations For versions prior to 5.2.9, update to version 5.2.9 or later to resolve the issue. As a temporary workaround, consider ensuring that all links to business websites contain rel="noopener" or similar attributes to prevent tabnabbing. Restrict access to configuring business website links to trusted users to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-5182

Affected Products

Wp-Businessdirectory

References · 4

• https://cmsjunkie.com/blog/joomla_business_directory_5-2-9_release · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5182 · Security Note
• https://t.me/cvenotify/727 · Telegram Post