VDB
Sign up
MEDIUM4.4

GHSA-v86m-j5f7-ccwh

Passbolt Api E-mail HTML injection

Quick fix

GHSA-v86m-j5f7-ccwh — passbolt/passbolt_api: upgrade to the fixed version with the command below.

composer require passbolt/passbolt_api:^2.7.0

Details

Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description.

Passbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail.

An authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent.

This vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/passbolt/passbolt_api
Introduced in: 0Fixed in: 2.7.0
Fixcomposer require passbolt/passbolt_api:^2.7.0

References