DerScanner
Home / Vulnerability Database / TypeScript : Unsafe target link
TypeScript

TypeScript : Unsafe target link

Classification

OWASP Top 10 2017
A6-Security Misconfiguration
OWASP Top 10 2021
A4-Insecure DesignA5-Security Misconfiguration
PCI DSS 4.0
7.2.6
HIPAA
§164.312 (a)(1)
CWE
CWE-266CWE-1022

Overview

The application uses links with the attribute target="_blank", which allows you to load the page by reference in a new browser window. The loaded page accesses the source page through the window.opener object. Without setting restrictions on changes to the properties of the window.opener object, it is possible to redirect the user to a phishing site.

References

  1. CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
  2. OWASP Top 10 2017-A6-Security Misconfiguration
  3. Target=“_blank” - the most underestimated vulnerability ever
MEDIUM

DerScanner Severity Score

Do you want to fix TypeScript : Unsafe target link in your application?

See also

TypeScript

TypeScript : Unsafe Azure access control

TypeScript

TypeScript : Debug code

TypeScript

TypeScript : XSS protection is disabled