GHSA-588M-9QG5-35PQ中危已审查

Reverse Tabnabbing in quill

OSV 1.4.0 · github-reviewed · 修改于 2021-09-29 06:06

发布时间

2020-09-04 01:19

GitHub 审查时间

2020-09-01 02:45

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/09/GHSA-588m-9qg5-35pq/GHSA-588m-9qg5-35pq.json

公告说明

Versions of quill prior to 1.3.7 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

受影响的软件包

npm

quill

ECOSYSTEM

引入0

标识信息

别名 / CVE

无

CWE

CWE-1022

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-588m-9qg5-35pq",
  "aliases": [],
  "details": "Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
  "summary": "Reverse Tabnabbing in quill",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.7"
            }
          ]
        }
      ],
      "package": {
        "name": "quill",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2021-09-28T22:06:18Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2020-09-03T17:19:09Z",
  "references": [
    {
      "url": "https://github.com/quilljs/quill/issues/2438",
      "type": "WEB"
    },
    {
      "url": "https://github.com/quilljs/quill/pull/2674",
      "type": "WEB"
    },
    {
      "url": "https://github.com/quilljs/quill",
      "type": "PACKAGE"
    },
    {
      "url": "https://www.npmjs.com/advisories/1039",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-1022"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-08-31T18:45:03Z"
  }
}