TabNabbing issue (due to taget=_blank)
M
Monero
Submitted None
Actions:
Reported by
ursa
Vulnerability Details
Technical details and impact analysis
Hi team,
i get to know in this particular url
https://getmonero.org/get-started/what-is-monero/ and i found one 3rd party url.
Issue lies Here :
<a href="https://www.openhub.net/p/monero" target="_blank">
Here i can see you are using target=_blank and no more rel tag.
Here , target=_blank means it will open in another new tab. but due to tabnabbing it can change parent tab as well .
so as per security principal , don't trust much on 3rd party. and be at your safe sight,
i can recommend you to add rel="noreferer, ,noopener" to avoid this issue.
So final tag for that particular anchor tag will be:
<a href="https://www.openhub.net/p/monero" target="_blank rel="norefere,noopener" type="link">
Thanks,
Report Details
Additional information and metadata
State
Closed
Substate
Resolved