CVE-2021-3660: Medium severity cockpit-project cockpit vulnerability
Cockpit (and its plugins) do not seem to protect itself against clickjacking : it is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry.
This may be used by a malicious website in clickjacking, or similar, attacks.
To prevent this behavior, a X-Frame-Options header could be added to the responses.
Other sources
Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-3660?
CVE-2021-3660 is a vulnerability in Cockpit (and its plugins) that allows clickjacking attacks.
How does CVE-2021-3660 work?
CVE-2021-3660 allows a malicious website to render a page from a Cockpit server via an <iFrame> HTML entry, enabling clickjacking or similar attacks.
Which software versions are affected by CVE-2021-3660?
CVE-2021-3660 affects all versions up to 254 of Cockpit and Redhat Enterprise Linux 8.0.
What is the severity of CVE-2021-3660?
CVE-2021-3660 has a severity rating of medium, with a CVSS score of 4.3.
How can I protect against CVE-2021-3660?
To protect against CVE-2021-3660, ensure that your Cockpit installation implements X-Frame-Options to prevent clickjacking attacks.