CVE-2021-3660

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

• CWE-1021
• CWE-1021

• https://bugzilla.redhat.com/show_bug.cgi?id=1980688Issue Tracking, Third Party Advisory
• https://github.com/cockpit-project/cockpit/commit/8d9bc10d8128aae03dfde62fd00075fe492ead10Patch, Third Party Advisory
• https://github.com/cockpit-project/cockpit/issues/16122Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1980688Issue Tracking, Third Party Advisory
• https://github.com/cockpit-project/cockpit/commit/8d9bc10d8128aae03dfde62fd00075fe492ead10Patch, Third Party Advisory
• https://github.com/cockpit-project/cockpit/issues/16122Patch, Third Party Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36581Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It…9.8
• CVE-2021-36582In Kooboo CMS 2.1.1.0, it is possible to upload a remote she…9.8
• CVE-2021-36584An issue was discovered in GPAC 1.0.1. There is a heap-based…5.5
• CVE-2021-3659A NULL pointer dereference flaw was found in the Linux kerne…5.5
• CVE-2021-36593Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36594Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36601GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vu…6.1
• CVE-2021-36603Cross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows …6.1
• CVE-2021-36605engineercms 1.03 is vulnerable to Cross Site Scripting (XSS)…5.4
• CVE-2021-36608Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 …5.4
• CVE-2021-36609Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 …5.4
• CVE-2021-3661A potential security vulnerability has been identified in ce…8.4