CVE-2022-3260
First published: Wed Jul 13 2022(Updated: )
Description of the problem: The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack. Clickjacking, also known as a 'UI redress attack', is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is 'hijacking' clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both. Release version: 2.4.4 Operator snapshot version: Unknown OCP version: 4.9 Browser Info: Unknown Steps to reproduce: 1. Login into the application Using "admin1" user 2. Navigate to search >> filter 3. Intercept the request using a proxy tool 4. Apply attack value in parameter Parameter: filters Attack Value: [{"property":"kind","values":["test"]},{"property":"'b) OR (1","values":["1'"]} Actual results: Expected results: Additional info:
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Openshift | =4.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-3260.
What is the severity of CVE-2022-3260?
The severity of CVE-2022-3260 is medium with a score of 4.8.
How does CVE-2022-3260 exploit work?
CVE-2022-3260 exploits the Clickjacking vulnerability by not enabling the X-FRAME-OPTIONS header in the response, which allows attackers to load the vulnerable website within an iframe on a malicious site.
Which browsers are vulnerable to clickjacking attacks due to CVE-2022-3260?
Some browsers may interpret the results incorrectly and are vulnerable to clickjacking attacks due to CVE-2022-3260.
How can I fix CVE-2022-3260?
To fix CVE-2022-3260, enable the X-FRAME-OPTIONS header in the response, which helps prevent clickjacking attacks.
- agent/type
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-3260
- vendor/redhat
- canonical/redhat openshift
- version/redhat openshift/4.9