PT-2021-3773 · Cockpit+6 · Cockpit+6

Rrandecker · Published 2021-07-20 · Updated 2023-02-12 · CVE-2021-3660

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cockpit (affected versions not specified)

Description The issue is related to clickjacking attacks, where a malicious website can render a page from a Cockpit server inside an iframe HTML entry. This could be exploited by a malicious website to perform clickjacking or similar attacks. The vulnerability is also associated with errors in displaying the user interface or frames, which could allow a remote attacker to inject malicious code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

ALSA-2022:2008

ALT-PU-2022-3242

BDU:2021-04029

CESA-2022_2008

CVE-2021-3660

MGASA-2021-0467

OESA-2021-1359

RHSA-2022:2008

RHSA-2022_2008

RLSA-2022:2008

Affected Products

Alt Linux

Almalinux

Centos

Cockpit

Debian

Red Hat

Rocky Linux

References · 38

• https://github.com/cockpit-project/cockpit/issues/16122 · Patch
• https://github.com/cockpit-project/cockpit/commit/8d9bc10d8128aae03dfde62fd00075fe492ead10 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/XQLK6K2XNAT4GT54IRSTVXU2RMN6V3YB · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:2008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3660 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-3660 · Security Note
• https://advisories.mageia.org/MGASA-2021-0467.html · Security Note
• https://osv.dev/vulnerability/CVE-2021-3660 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0467 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3660 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3660 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:2008 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1359 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-2008.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3660 · Vendor Advisory