VYPR

CWE-1022

Use of Web Link to Untrusted Target with window.opener Access

VariantIncompleteLikelihood: Medium

Description

The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

When a user clicks a link to an external site ("target"), the target="_blank" attribute causes the target site's contents to be opened in a new window or tab, which runs in the same process as the original page. The window.opener object records information about the original page that offered the link. If an attacker can run script on the target page, then they could read or modify certain properties of the window.opener object, including the location property - even if the original and target site are not the same origin. An attacker can modify the location property to automatically redirect the user to a malicious site, e.g. as part of a phishing attack. Since this redirect happens in the original window/tab - which is not necessarily visible, since the browser is focusing the display on the new target page - the user might not notice any suspicious redirection.

Hierarchy (View 1000)

Parents

Children

none

CVEs mapped to this weakness (13)

  • CVE-2022-1583MedMay 30, 2022
    WordPress
    External Links in New Window / New Tab
    risk 0.42cvss 6.5epss 0.01

    The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.

  • CVE-2024-39727MedDec 25, 2024
    IBM
    Engineering Insights
    risk 0.40cvss 6.1epss 0.00

    IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web…

  • CVE-2021-33697MedSep 15, 2021
    SAP
    Businessobjects Business Intelligence
    risk 0.40cvss 6.1epss 0.01

    Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

  • CVE-2025-33014MedJul 18, 2025
    IBM
    Sterling B2b Integrator
    risk 0.35cvss 5.4epss 0.00

    IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform…

  • CVE-2022-2600MedAug 22, 2022
    WordPress
    Auto-hyperlink URLs
    risk 0.35cvss 5.4epss 0.01

    The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.

  • CVE-2020-36624MedDec 22, 2022
    ahorner
    text-helpers
    risk 0.34cvss 6.3epss 0.01

    A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with…

  • CVE-2021-39112MedAug 25, 2021
    Atlassian
    Jira
    risk 0.31cvss 4.8epss 0.01

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from…

  • CVE-2025-42941LowAug 12, 2025
    SAP
    Fiori
    risk 0.23cvss 3.5epss 0.00

    SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link () elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While…

  • CVE-2025-59842MedSep 26, 2025
    Jupyter
    Jupyterlab
    risk 0.21cvss 4.3epss 0.00

    jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include…

  • CVE-2026-71555MedAug 6, 2026
    Thm Health
    Pilos
    risk 0.20cvss 4.1epss 0.00

    PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain…

  • CVE-2018-25058MedDec 29, 2022
    Twitter Post Fetcher Project
    Twitter Post Fetcher
    risk 0.20cvss 4.2epss 0.01

    A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener…

  • CVE-2018-25089LowAug 28, 2023
    Glb
    Meetup Tag
    risk 0.00cvss 3.5epss 0.01

    A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access.…

  • CVE-2022-4927MedMar 5, 2023
    Ualberta
    Neosdiscovery
    risk 0.00cvss 5.5epss 0.00

    A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/_refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access.…