NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"GHSA-qm5v-pj64-852j

MEDIUMFix: passbolt/passbolt_api@f568e11

GHSA-qm5v-pj64-852j is a medium-severity (CVSS 5.5) vulnerability in passbolt/passbolt_api. A fix is available for passbolt/passbolt_api — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 5, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘passbolt/passbolt_api

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Description

A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object.

Impact of issue

The newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data.

Fix

The code that opens a new window via window.open(); now open the tab with the noopener attribute.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistpassbolt/passbolt_apiall versions2.11.0composer require passbolt/passbolt_api:^2.11.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for passbolt/passbolt_api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update passbolt/passbolt_api to 2.11.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qm5v-pj64-852j is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. ### Impact of issue The newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data. ### Fix The code that opens a new window via window.open(); now open the tab with the noopener attribute.
O3 Security · Impact-Aware SCA

Is GHSA-qm5v-pj64-852j in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Passbolt Api Tabnabbing when opening URI with menu…