CVE-2020-5182

MEDIUM

J-BusinessDirectory < 5.2.9 - Reverse Tabnabbing via Business Website Link

Title source: llm
STIX 2.1

Description

The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" (or similar attributes such as noreferrer), the tabnabbing may occur. To reproduce the bug, create a business with a website link that contains JavaScript to exploit the window.opener property (for example, by setting window.opener.location).

References (1)

Core 1
Core References
Release Notes, Vendor Advisory x_refsource_confirm
https://www.cmsjunkie.com/blog/joomla_business_directory_5-2-9_release/

Scores

CVSS v3 6.5
EPSS 0.0105
EPSS Percentile 59.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-269
Status published
Products (1)
cmsjunkie/j-businessdirectory < 5.2.9
Published Feb 03, 2020
Tracked Since Feb 18, 2026