CVE-2021-3660
CVE-2021-3660
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.
CVSS 4.3 · Medium · EPSS 1.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
cockpit
- Versions
- Fixed in cockpit v254 and later.: Affected
No fix published
cockpit Debian:12
- Affected ranges
- ECOSYSTEM: < 254-1
Update to 254-1
cockpit Debian:13
- Affected ranges
- ECOSYSTEM: < 254-1
Update to 254-1
cockpit Debian:14
- Affected ranges
- ECOSYSTEM: < 254-1
Update to 254-1
cockpit Ubuntu:18.04:LTS
- Versions
- 151-1
- 156-1
- 157-1
- 158-1
- 160-1
- 161-1
- 162-1
- 163-1
- 164-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit Ubuntu:20.04:LTS
- Versions
- 202.1-1
- 204-1
- 206-1
- 207-1
- 208-1
- 210-1
- 211-1
- 212-1
- 213-1
- 214.1-1
- 215-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published