Medium severity · published Aug 28, 2023
CVE-2018-25089
glb Meetup Tag Extension Link Attribute reverse tabnabbing
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was found in glb Meetup Tag Extension 0.1 on MediaWiki. It has been rated as problematic. This issue affects some unknown processing of the component Link Attribute Handler. The manipulation leads to use of web link to untrusted target with window.opener access. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 850c726d6bbfe0bf270801fbb92a30babea4155c. It is recommended to upgrade the affected component. The identifier VDB-238157 was assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
Meetup Tag Extension · glb
0.1 · source: vendor
MT
Meetup Tag · Glb
0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25089
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25089
Patch
https://github.com/glb/mediawiki-tag-extension-meetup/commit/850c726d6bbfe0bf270801fbb92a30babea4155c
Release Notes
https://github.com/glb/mediawiki-tag-extension-meetup/releases/tag/v0.2
Permissions Required
https://vuldb.com/?ctiid.238157
Third Party Advisory
https://vuldb.com/?id.238157