GitHub Advisoryadvisory · PyPI

GHSA-m379-x4xc-38x9 rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames

CRITICAL Published 2022-09-09 Modified 2024-10-25 Official page ↗
Aliases
CVE-2022-3167
Ecosystem
PyPI
Packages
rdiffweb
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-1021
Reviewed
2022-09-16

Affected packages

• PyPI rdiffweb: < 2.4.1 → fixed in 2.4.1

Description

rdiffweb prior to 2.4.1 is vulnerable to Improper Restriction of Rendered UI Layers or Frames. This allows attackers to perform clickjacking attacks that can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion. This issue has been patched in version 2.4.1.

Related

Alias · CVE (1)

  • CVE-2022-3167 Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1. vulnerability

Weakness · CWE (1)

  • CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness

References