CVE-2021-3660

Katalog CVE

CVSS 4.3 · Medium EPSS 1,3%

Kerentanan Improper Restriction of Rendered UI Layers or Frames pada cockpit-project cockpit, redhat enterprise linux. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Rincian

Terbit di NVD

10 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cockpit-project/cockpit/commit/8d9bc10d8128aae03dfde62fd00075fe492ead10 patch · advisory pihak ketiga
• https://github.com/cockpit-project/cockpit/issues/16122 patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1980688 issue tracking · advisory pihak ketiga