Reverse Tabnabbing Vulnerability in DOMPurify by Cure53
CVE-2019-25155

6.1MEDIUM

Key Information:

Vendor

Cure53

Status
Dompurify
Vendor
CVE Published:
7 November 2023

What is CVE-2019-25155?

A vulnerability has been identified in DOMPurify versions prior to 1.0.11 that allows for reverse tabnabbing through unprotected links. This flaw arises because links in the demo file lack the essential 'rel="noopener noreferrer"' attribute, which can expose users to phishing attacks when a new tab is opened. Implementing this security attribute is crucial to safeguarding against this type of attack, enhancing the overall security of web applications utilizing DOMPurify.

References

https://github.com/cure53/DOMPurify/pull/337/files
https://github.com/cure53/DOMPurify/compare/1.0.10...1.0.11

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.