REDHAT-BUG-1980688: Low severity Cockpit Cockpit vulnerability
Cockpit (and its plugins) do not seem to protect itself against clickjacking : it is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry.
This may be used by a malicious website in clickjacking, or similar, attacks.
To prevent this behavior, a X-Frame-Options header could be added to the responses.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1980688?
REDHAT-BUG-1980688 is considered a medium severity vulnerability due to its potential for clickjacking attacks.
How do I fix REDHAT-BUG-1980688?
To mitigate REDHAT-BUG-1980688, ensure that your Cockpit installation is configured to set the X-Frame-Options HTTP header appropriately.
What is clickjacking in relation to REDHAT-BUG-1980688?
Clickjacking is an attack where a malicious website tricks a user into clicking on something different from what they perceive, potentially exploiting vulnerabilities like REDHAT-BUG-1980688.
Which versions of Cockpit are affected by REDHAT-BUG-1980688?
REDHAT-BUG-1980688 affects all versions of Cockpit that do not implement protection against clickjacking.
Is there any workaround while fixing REDHAT-BUG-1980688?
A temporary workaround for REDHAT-BUG-1980688 is to restrict access to the Cockpit server and avoid embedding it in iframes.