GHSA-v86m-j5f7-ccwh
Passbolt Api E-mail HTML injection
Quick fix
GHSA-v86m-j5f7-ccwh — passbolt/passbolt_api: upgrade to the fixed version with the command below.
composer require passbolt/passbolt_api:^2.7.0Details
Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description.
Passbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail.
An authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent.
This vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 2.7.0composer require passbolt/passbolt_api:^2.7.0References
- https://github.com/passbolt/passbolt_api/commit/00f0ebe37d78815adee26d5e80cf2250fe878647[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-3.yaml[WEB]
- https://github.com/passbolt/passbolt_api[PACKAGE]
- https://www.passbolt.com/incidents/20190211_multiple_vulnerabilities[WEB]