cve.bz

CWE-1021: Improper Restriction of Rendered UI Layers or Frames, page 4

Filter

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

What the weakness is: CWE-1021 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 7
  • CAPEC-103 Clickjacking Likelihood: Medium · Severity: High
  • CAPEC-181 Flash File Overlay Severity: Medium
  • CAPEC-222 iFrame Overlay Likelihood: Medium · Severity: High
  • CAPEC-504 Task Impersonation Likelihood: Medium · Severity: High
  • CAPEC-506 Tapjacking Likelihood: Low · Severity: Low
  • CAPEC-587 Cross Frame Scripting (XFS) Severity: High
  • CAPEC-654 Credential Prompt Impersonation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-1021, as MITRE names them. Credits.

Ask an AI about CWE-1021

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1021: Improper Restriction of Rendered UI Layers or Frames and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1021.html and https://cve.bz/cve/cwe/1021?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2024-31323EPSS 0.1%

    In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …

  2. 6.8CVE-2024-2177EPSS 0.7%

    A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow…

  3. 6.1CVE-2024-30109EPSS 0.4%

    HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.

  4. 5.4CVE-2023-42011EPSS 0.2%

    IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is…

  5. 8.1CVE-2024-33377EPSS 0.4%

    LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page.

  6. 6.1CVE-2024-5698EPSS 0.4%

    By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 12…

  7. 6.1CVE-2024-2383EPSS 0.4%

    A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to…

  8. 6.5CVE-2024-4950EPSS 0.9%

    Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity:…

  9. 5.4CVE-2023-47774EPSS 0.3%

    Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7.

  10. 6.5CVE-2024-3911EPSS 0.5%

    An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.

  11. 4.3CVE-2024-29981EPSS 0.7%

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

  12. 7.5CVE-2024-2613EPSS 0.5%

    Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124.

  13. 6.1CVE-2024-28196EPSS 0.4%

    your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version < 1.9.0 does not prevent other pages from displaying it in an iframe and is thus vulnerable to clickjacking. Clickjacking can be used to trick an e…

  14. 4.3CVE-2024-26167EPSS 0.9%

    Microsoft Edge for Android Spoofing Vulnerability

  15. 5.4CVE-2024-1890EPSS 0.5%

    Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.

  16. 6.1CVE-2024-1550EPSS 0.6%

    A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions…

  17. 6.1CVE-2023-45698EPSS 0.3%

    Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.

  18. 3.3CVE-2024-20810EPSS 0.2%

    Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information.

  19. 7.1CVE-2024-0669EPSS 0.3%

    A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.

  20. 4.7CVE-2022-32919EPSS 0.6%

    The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Visiting a website that frames malicious content may lead to UI spoofing.

  21. 6.1CVE-2023-6093EPSS 0.3%

    A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly restricts frame objects, which can lead to user confusion about which interface the…

  22. 6.1CVE-2023-6867EPSS 0.7%

    The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permissi…

  23. 6.1CVE-2023-4958EPSS 0.6%

    In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS us…

  24. 6.1CVE-2023-2265EPSS 0.4%

    An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated attacker to perform clickjacking based attacks against an authenticated and authorized user. See …

  25. 6.5CVE-2023-6211EPSS 0.5%

    If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to participate i…

  26. 5.4CVE-2023-6206EPSS 0.6%

    The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would…

  27. 6.1CVE-2023-47311EPSS 0.4%

    An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.

  28. 4.3CVE-2023-4956EPSS 0.5%

    A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it…

  29. 6.1CVE-2023-36920EPSS 0.4%

    In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which …

  30. 4.3CVE-2023-5721EPSS 0.8%

    It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.…

  31. 9.6CVE-2023-41897EPSS 1.1%

    Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and co…

  32. 4.3CVE-2023-5103EPSS 0.6%

    Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensitive information via tricking a user into clicking on an actionable item using an iframe.

  33. 6.5CVE-2023-38873EPSS 0.8%

    The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into cli…

  34. 6.1CVE-2023-30961EPSS 0.4%

    Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.

  35. 3.7CVE-2023-0654EPSS 0.2%

    Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would b…

  36. 4.7CVE-2023-4229EPSS 0.4%

    A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with maliciou…

  37. 5.4CVE-2023-37455EPSS 0.3%

    The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability affects Firefox for iOS < 115.

  38. 5.3CVE-2023-34658EPSS 0.4%

    Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.

  39. 7.8CVE-2022-20443EPSS 0.09%

    In hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…

  40. 6.1CVE-2023-23343EPSS 0.3%

    A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an …

  41. 4.3CVE-2023-2013EPSS 0.7%

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to…

  42. 4.3CVE-2023-3140EPSS 0.4%

    Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window …

  43. 4.3CVE-2023-28159EPSS 0.3%

    The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Firefox for Android. Other operating systems are unaf…

  44. 4.3CVE-2023-25748EPSS 0.3%

    By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Firefox for Android. Other operating systems are unaf…

  45. 5.4CVE-2023-25730EPSS 0.5%

    A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects …

  46. 6.5CVE-2022-43378EPSS 0.5%

    A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performing unintended actions when external address frames are not properly restricted. Affected Produ…

  47. 6.1CVE-2023-1362ExploitEPSS 1.4%

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.

  48. 6.1CVE-2022-32891EPSS 0.7%

    The issue was addressed with improved UI handling. This issue is fixed in Safari 16, tvOS 16, watchOS 9, iOS 16. Visiting a website that frames malicious content may lead to UI spoofing.

  49. 5.4CVE-2023-0780EPSS 0.4%

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.

  50. 4.7CVE-2022-40268EPSS 0.5%

    Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electric Corporation GOT2000 Series GT25 model versions 01.14.000 t…