medium4.3
CVE-2021-3660
Cockpit (and its plugins) do not seem to protect itself against clickjacking.
Impact
Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cockpit-Project | Cockpit | before 254 |
| Redhat | Enterprise Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.redhat.com/show_bug.cgi?id=1980688
- https://github.com/cockpit-project/cockpit/commit/8d9bc10d8128aae03dfde62fd00075fe492ead10
- https://github.com/cockpit-project/cockpit/issues/16122
- https://bugzilla.redhat.com/show_bug.cgi?id=1980688
- https://github.com/cockpit-project/cockpit/commit/8d9bc10d8128aae03dfde62fd00075fe492ead10
- https://github.com/cockpit-project/cockpit/issues/16122