CVE-2020-5182: Medium severity CMSJunkie J-businessdirectory Joomla\! vulnerability
The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" (or similar attributes such as noreferrer), the tabnabbing may occur. To reproduce the bug, create a business with a website link that contains JavaScript to exploit the window.opener property (for example, by setting window.opener.location).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
J-BusinessDirectory extensionto a version that resolves this vulnerability.Fixed in 5.2.9 - Configuration
Ensure outbound links generated from the business website field include rel="noopener" (or similar like "noreferrer") to prevent reverse tabnabbing via window.opener.
J-BusinessDirectory extension (Joomla!) business website link handling (rel="noopener"/"noreferrer" on outbound links) = Add rel="noopener" (or similar, e.g., "noreferrer") to outbound anchor tags that reference the business website - Configuration
In configurations where the business website link can be entered by any user, restrict this ability to trusted users to prevent injection of JavaScript into the window.opener context.
J-BusinessDirectory extension (Joomla!) permission to enter business website link = Restrict to trusted users only
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5182?
The severity of CVE-2020-5182 is considered low, as it primarily involves potential user experience issues rather than direct threats.
How do I fix CVE-2020-5182?
To fix CVE-2020-5182, update the J-BusinessDirectory extension to version 5.2.9 or higher.
What is Reverse Tabnabbing in CVE-2020-5182?
Reverse Tabnabbing refers to the technique where a newly opened tab can change the location of its originating tab, risking user information.
Who is affected by CVE-2020-5182?
Users of the J-BusinessDirectory extension for Joomla! version prior to 5.2.9 are affected by CVE-2020-5182.
Is CVE-2020-5182 an urgent vulnerability to address?
While CVE-2020-5182 poses a risk, it is not deemed urgent due to its nature, but it is advisable to apply the fix to ensure best practices.