目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1021 不当限制渲染UI层或帧 类漏洞列表 130

CWE-1021 不当限制渲染UI层或帧 类弱点 130 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1021属于界面层限制不当漏洞，指Web应用未正确限制来自其他应用或域名的框架对象及UI层。攻击者常利用此缺陷，通过嵌入恶意iframe或覆盖合法界面，实施点击劫持或内容注入，诱导用户交互以窃取数据或执行未授权操作。开发者应避免直接嵌入不可信源，通过设置X-Frame-Options响应头或Content-Security-Policy策略，严格限制页面被帧嵌入的范围，从而有效隔离不同域名的UI层，保障用户界面完整性。

MITRE CWE 官方描述
CWE：CWE-1021 渲染 UI 层或框架的限制不当 英文：Web 应用程序未对属于其他应用程序或域名的 frame 对象或 UI 层进行限制，或限制不当。
常见影响 (1)
Access Control Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data
An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trick the user into changing privacy…
缓解措施 (4)
Implementation The use of X-Frame-Options allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps. There is a need for allowing frames from multip…
Implementation A developer can use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support X-Frame-Options security feature previously mentioned. It is also important to note that this tactic has been circumvented or bypassed. Improper usage of frames can persist in the web application through nested frames. The "frame-breaking" script does no…
Implementation This defense-in-depth technique can be used to prevent the improper usage of frames in web applications. It prioritizes the valid sources of data to be loaded into the application through the usage of declarative policies. Based on which implementation of Content Security Policy is in use, the developer should use the "frame-ancestors" directive or the "frame-src" directive to mitigate this weakne…
Implementation In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-41897 Home Assistant 安全漏洞 — core 8.8 High 2023-10-19
CVE-2023-5103 SICK APU RDT400 安全漏洞 — APU0200 4.3 Medium 2023-10-09
CVE-2023-0654 Cloudflare WARP 安全漏洞 — WARP Client 3.9 Low 2023-08-29
CVE-2023-4229 MOXA ioLogik 4000 Series 安全漏洞 — ioLogik 4000 Series 4.3 Medium 2023-08-24
CVE-2023-3140 KNIME Business Hub 安全漏洞 — KNIME Business Hub 4.3 Medium 2023-06-07
CVE-2022-43378 Schneider Electric NetBotz 安全漏洞 — NetBotz 4 - 355/450/455/550/570 6.5 Medium 2023-04-18
CVE-2023-1362 bumsys 安全漏洞 — unilogies/bumsys 5.4 - 2023-03-13
CVE-2023-0780 cockpit 安全漏洞 — cockpit-hq/cockpit 5.4 - 2023-02-11
CVE-2022-40268 Mitsubishi Electric GOT2000和GT SoftGOT2000 安全漏洞 — GOT2000 Series GT27 model 6.1 Medium 2023-02-02
CVE-2022-32517 Schneider Electric Conext ComBox 安全漏洞 — Conext™ ComBox 6.5 Medium 2023-01-30
CVE-2023-0057 pyload 安全漏洞 — pyload/pyload 6.1 - 2023-01-05
CVE-2022-3260 Red Hat OpenShift 安全漏洞 — Openshift 5.4 - 2022-12-08
CVE-2022-3167 Rdiffweb 安全漏洞 — ikus060/rdiffweb 7.1 - 2022-09-08
CVE-2022-2965 notrinoserp 安全漏洞 — notrinos/notrinoserp 4.3 - 2022-08-23
CVE-2022-20820 Cisco Webex Meetings 跨站脚本漏洞 — Cisco Webex Meetings 5.4 Medium 2022-08-10
CVE-2022-20852 Cisco Webex Meetings 输入验证错误漏洞 — Cisco Webex Meetings 5.4 Medium 2022-08-10
CVE-2022-2734 OpenEMR 安全漏洞 — openemr/openemr 5.4 - 2022-08-09
CVE-2022-33727 SAMSUNG Mobile devices 安全漏洞 — Samsung Mobile Devices 4.8 Medium 2022-08-05
CVE-2022-33723 SAMSUNG Mobile devices 安全漏洞 — Samsung Mobile Devices 4.8 Medium 2022-08-05
CVE-2022-2179 Rockwell Automation MicroLogix 1100 和 1400 安全漏洞 — MicroLogix 1400 6.5 Medium 2022-07-20
CVE-2022-28889 Apache Druid 安全漏洞 — Apache Druid 4.3 - 2022-07-07
CVE-2017-20041 UCWeb 安全漏洞 — UC Browser 5.4 Medium 2022-06-13
CVE-2022-1803 Trudesk 安全漏洞 — polonel/trudesk 8.2 - 2022-05-20
CVE-2022-28649 JetBrains YouTrack 安全漏洞 — YouTrack 4.6 Medium 2022-04-05
CVE-2022-24733 Sylius 安全漏洞 — Sylius 6.1 Medium 2022-03-14
CVE-2021-3660 Cockpit 安全漏洞 — cockpit 4.3 - 2022-03-07
CVE-2022-22807 EcoStruxure EV Charging Expert 安全漏洞 — EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) 7.4 - 2022-02-09
CVE-2022-22552 DELL EMC AppSync 安全漏洞 — AppSync 6.9 Medium 2022-01-21
CVE-2021-35237 Solarwinds Kiwi Syslog Server 安全漏洞 — Kiwi Syslog Server 5.0 Medium 2021-10-29
CVE-2021-38472 IR615 Router 安全漏洞 — IR615 Router 4.7 Medium 2021-10-19

CWE-1021（不当限制渲染UI层或帧） 是常见的弱点类别，本平台收录该类弱点关联的 130 条 CVE 漏洞。