Clickjacking Vulnerability in Cockpit by Cockpit Project

CVE-2021-3660

What is CVE-2021-3660?

Cockpit and its plugins lack adequate protections against clickjacking attacks, which allow an attacker to render pages from a Cockpit server within an on a malicious site. This vulnerability could enable exploitation through deceptive user interface behaviors, leading to unauthorized actions taken by users who are unaware they are interacting with a different site. Proper mitigation strategies should be employed to prevent misuse of this vulnerability.

References