GHSA-v86m-j5f7-ccwh: Passbolt Api E-mail HTML injection
Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description.
Passbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail.
An authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent.
This vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-3.yaml
- github.com/advisories/GHSA-v86m-j5f7-ccwh
- github.com/passbolt/passbolt_api
- github.com/passbolt/passbolt_api/commit/00f0ebe37d78815adee26d5e80cf2250fe878647
- www.passbolt.com/incidents/20190211_multiple_vulnerabilities
Code Behaviors & Features
Detect and mitigate GHSA-v86m-j5f7-ccwh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →