5.3

CVE-2018-25089

glb Meetup Tag Extension Link Attribute reverse tabnabbing

A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 850c726d6bbfe0bf270801fbb92a30babea4155c. It is recommended to upgrade the affected component. The identifier VDB-238157 was assigned to this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Glb ≫ Meetup Tag Version0.1 SwPlatformmediawiki
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.5% 0.389
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cna@vuldb.com 3.5 2.1 1.4
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
cna@vuldb.com 2.7 5.1 2.9
AV:A/AC:L/Au:S/C:N/I:P/A:N
CWE-1022 Use of Web Link to Untrusted Target with window.opener Access

The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

https://github.com/glb/mediawiki-tag-extension-meetup/commit/850c726d6bbfe0bf270801fbb92a30babea4155c
Patch
https://github.com/glb/mediawiki-tag-extension-meetup/releases/tag/v0.2
Release Notes
https://vuldb.com/?ctiid.238157
Third Party Advisory
Permissions Required
https://vuldb.com/?id.238157
Third Party Advisory