CVE-2019-25155

Summary

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/cure53/DOMPurify/pull/337/files
• https://github.com/cure53/DOMPurify/compare/1.0.10…1.0.11

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/cure53/DOMPurify/pull/337/files
• https://github.com/cure53/DOMPurify/compare/1.0.10…1.0.11

• ←Previous
• Next→