DerScanner
Home / Vulnerability Database / HTML5 : Unsafe target link
HTML5

HTML5 : Unsafe target link

Classification

OWASP Top 10 2017
A6-Security Misconfiguration
OWASP Top 10 2021
A4-Insecure DesignA5-Security Misconfiguration
PCI DSS 4.0
7.2.6
HIPAA
§164.312 (a)(1)
CWE
CWE-266CWE-1022

Overview

The application uses links with the attribute target="_blank", which allows you to load the page by reference in a new browser window. The loaded page accesses the source page through the window.opener object. Without setting restrictions on changes to the properties of the window.opener object, it is possible to redirect the user to a phishing site.

References

  1. CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
  2. OWASP Top 10 2017-A6-Security Misconfiguration
  3. Target=“_blank” - the most underestimated vulnerability ever
MEDIUM

DerScanner Severity Score

Do you want to fix HTML5 : Unsafe target link in your application?

See also

HTML5

HTML5 : Missing required cryptographic step

HTML5

HTML5 : Weak hashing algorithm

HTML5

HTML5 : Cross-site request forgery (CSRF)