Weakness (CWE)
CWE-1021: Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
How to prevent it (4 mitigations)
-
Implementation
Use the "frame-ancestors" directive in the Content Security Policy, which is intended to define restrictions when it comes to allowing embedded content [REF-1544].
-
Implementation
The use of X-Frame-Options (now partially obsolete as of September 2026 [REF-1545]) allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content.
The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps; often, there is a need for allowing frames from multiple domains.
-
Implementation
Use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support the X-Frame-Options security feature previously mentioned (which is now partially obsolete).
-
Implementation
In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
Source: MITRE CWE-1021
247 results · Feed
-
High 7.5
When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates th…
-
Medium 4.3
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to…
-
Medium 4.3
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers be…
-
Medium 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …
-
Medium 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…
-
Medium 6.5
In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/o…
-
Medium 6.5
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue i…
-
Medium 6.1
AeroCMS v0.0.1 is vulnerable to ClickJacking.
-
High 7.3
In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API…
-
High 7.3
In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malici…
-
Medium 4.8
The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers w…
-
Medium 5.4
IBM CICS TX clickjacking
IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch furth…
-
Medium 6.1
The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Saf…
-
Medium 6.1
Hashicorp Boundary vulnerable to clickjacking
Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.
-
Critical 10.0
Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb
Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
-
Medium 6.4
Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserp
Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7.
-
Medium 5.4
Cisco Webex Meetings Web Interface Vulnerabilities
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilitie…
-
Medium 5.4
Cisco Webex Meetings Web Interface Vulnerabilities
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilitie…
-
Critical 10.0
Improper Restriction of Rendered UI Layers or Frames in openemr/openemr
Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.
-
Medium 4.8
A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the u…
-
Medium 4.8
A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the use…
-
Medium 6.5
ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames
The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
-
Medium 4.3
Clickjacking in the web console
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.
-
Medium 5.4
Ucweb UC Browser HTML URL improper restriction of rendered ui layers
A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It i…
-
High 8.4
Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk
Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.
-
Medium 4.6
In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue d…
-
Medium 6.1
Improper Restriction of Rendered UI Layers or Frames in Sylius
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays…
-
Medium 6.1
Spoofing attack in swagger-ui-dist
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's cli…
-
Unscored —
Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a co…
-
Unscored —
A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifi…
-
Medium 6.9
Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker…
-
Medium 5.0
Clickjacking Vulnerability
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, suc…
-
Medium 4.7
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router’s management portal and coul…
-
Medium 5.4
Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin
grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames
-
Unscored —
Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud
A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerabilit…
-
Medium 6.5
Improper Restriction of Rendered UI Layers or Frames in yourls/yourls
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
-
Medium 5.9
Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
-
Unscored —
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s…
-
Unscored —
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and…
-
Medium 6.1
EC-CUBE Improper Restriction of Rendered UI Layers or Frames
Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.