Description (CNA)
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| jgraph / drawio | affected < 29.7.9 |
CWE
CWE-601, CWE-200
References
- https://github.com/jgraph/drawio/security/advisories/GHSA-8x7j-m8px-7p8x
- https://github.com/jgraph/drawio/issues/493
- https://github.com/jgraph/drawio/releases/tag/v29.7.9
ADP enrichment
No English description supplied.
No references supplied.