CVE-2018-25089 (published 2023-08-28T13:15Z)

A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 850c726d6bbfe0bf270801fbb92a30babea4155c. It is recommended to upgrade the affected component. The identifier VDB-238157 was assigned to this vulnerability.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/glb/mediawiki-tag-extension-meetup
commit_details: repo_url: https://github.com/glb/mediawiki-tag-extension-meetup
author: Geoff Baskwill
author_date: 2018-02-21 19:00:58-05:00
msg: Mitigate "reverse tabnabbing" vulnerability

"Reverse Tabnabbing" is an attack where a page linked from the target
page is able to rewrite that page; the vulnerability is opened by use
of the `target="_blank"` link attribute.

Removed `target="_blank"` and added `rel="noopener noreferer"` as well
as advised in the OWASP cheat sheet.

https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet#Tabnabbing
https://www.owasp.org/index.php/Reverse_Tabnabbing
repository: repo_url: https://github.com/glb/mediawiki-tag-extension-meetup
repo_name: glb/mediawiki-tag-extension-meetup
description: Meetup tag extension for mediawiki.
repo_language: PHP
owner: glb
file_changes: filename: Meetup.class.php
change_type: ModificationType.MODIFY
diff: @@ -120,8 +120,7 @@ class Meetup
 		$group = urlencode($group);
 
 		$ret .= Html::rawElement( 'a', array(
-				'target' => '_blank',
-				'rel' => 'nofollow',
+				'rel' => 'nofollow noopener noreferrer',
 				'class' => 'external text meetup-badge',
 				'href' => wfMessage( 'meetup-group-ui-url', $group )->plain(),
 			), wfMessage( 'meetup-group-link-text')->parse() );
@@ -211,8 +210,7 @@ class Meetup
 				$description = preg_replace(
 					'/(.{400})(.+)/',
 					'\1 ' . Html::rawElement( 'a', array(
-						'target' => '_blank',
-						'rel' => 'nofollow',
+						'rel' => 'nofollow noopener noreferrer',
 						'class' => 'external text',
 						'href' => $event['link'],
 					), wfMessage( 'meetup-read-more' )->parse() ),
@@ -222,8 +220,7 @@ class Meetup
 				$ret .= Html::rawElement( 'li', array(
 						'class' => 'event',
 					), Html::rawElement( 'a', array(
-						'target' => '_blank',
-						'rel' => 'nofollow',
+						'rel' => 'nofollow noopener noreferrer',
 						'class' => 'external text',
 						'href' => $event['link']
 					), sprintf( '%s (%s): %s',
@@ -245,8 +242,7 @@ class Meetup
 			$ret .= '</ul>';
 
 			$ret .= Html::rawElement( 'a', array(
-					'target' => '_blank',
-					'rel' => 'nofollow',
+					'rel' => 'nofollow noopener noreferrer',
 					'class' => 'external text',
 					'href' => wfMessage(
 						'meetup-events-ui-url', $group, $status

programming_language: PHP
filename: extension.json
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,6 @@
     "localBasePath": "",
     "remoteExtPath": "Meetup"
   },
-  "version": "0.1",
+  "version": "0.2",
   "manifest_version": 1
 }

programming_language: CoffeeScript