PT-2024-40435 · Packagist · Passbolt/Passbolt Api

Published 2024-05-20 · Updated 2024-05-20

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned, so the information is not available.

Description A user could create and share a resource with a malicious URI. When the victim opens the URI in a new tab using the "Open URI in a new tab" function, the malicious page gains access to the window.opener object. This allows the malicious page to change the window.opener.location to redirect the user to a phishing page or call a JavaScript function on the user's behalf, potentially affecting data integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-657

Related Identifiers

GHSA-QM5V-PJ64-852J

Affected Products

Passbolt/Passbolt Api

References · 5

• https://osv.dev/vulnerability/GHSA-qm5v-pj64-852j · Vendor Advisory
• https://github.com/passbolt/passbolt_api/commit/f568e113beb3134446eda9e66400d28d726ee20d · Note
• https://github.com/passbolt/passbolt_api · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-08-07-3.yaml · Note
• https://passbolt.com/incidents/20190807_multiple_vulnerabilities · Note