GHSA-v86m-j5f7-ccwh: Passbolt Api E-mail HTML injection
Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description.
Passbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail.
An authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent.
This vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-3.yaml
- github.com/advisories/GHSA-v86m-j5f7-ccwh
- github.com/passbolt/passbolt_api
- github.com/passbolt/passbolt_api/commit/00f0ebe37d78815adee26d5e80cf2250fe878647
- www.passbolt.com/incidents/20190211_multiple_vulnerabilities
Detect and mitigate GHSA-v86m-j5f7-ccwh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →