目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1021 不当限制渲染UI层或帧 类漏洞列表 130

CWE-1021 不当限制渲染UI层或帧 类弱点 130 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1021属于界面层限制不当漏洞，指Web应用未正确限制来自其他应用或域名的框架对象及UI层。攻击者常利用此缺陷，通过嵌入恶意iframe或覆盖合法界面，实施点击劫持或内容注入，诱导用户交互以窃取数据或执行未授权操作。开发者应避免直接嵌入不可信源，通过设置X-Frame-Options响应头或Content-Security-Policy策略，严格限制页面被帧嵌入的范围，从而有效隔离不同域名的UI层，保障用户界面完整性。

MITRE CWE 官方描述
CWE：CWE-1021 渲染 UI 层或框架的限制不当 英文：Web 应用程序未对属于其他应用程序或域名的 frame 对象或 UI 层进行限制，或限制不当。
常见影响 (1)
Access Control Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data
An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trick the user into changing privacy…
缓解措施 (4)
Implementation The use of X-Frame-Options allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps. There is a need for allowing frames from multip…
Implementation A developer can use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support X-Frame-Options security feature previously mentioned. It is also important to note that this tactic has been circumvented or bypassed. Improper usage of frames can persist in the web application through nested frames. The "frame-breaking" script does no…
Implementation This defense-in-depth technique can be used to prevent the improper usage of frames in web applications. It prioritizes the valid sources of data to be loaded into the application through the usage of declarative policies. Based on which implementation of Content Security Policy is in use, the developer should use the "frame-ancestors" directive or the "frame-src" directive to mitigate this weakne…
Implementation In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-3799 Grav-Plugin-Admin 访问控制错误漏洞 — getgrav/grav-plugin-admin 3.5 - 2021-09-27
CVE-2018-19957 QNAP NAS 安全漏洞 — QTS 6.1 - 2021-09-10
CVE-2021-3734 yourls 安全漏洞 — yourls/yourls 8.8 - 2021-08-26
CVE-2021-3731 LedgerSMB 安全漏洞 — ledgersmb/ledgersmb 5.9 Medium 2021-08-23
CVE-2021-27467 Emerson Rosemount X-STREAM Gas Analyzer 安全漏洞 — Emerson Rosemount X-STREAM Gas Analyzer 4.7 - 2021-05-20
CVE-2020-28218 Schneider Electric Easergy T300 安全漏洞 — Easergy T300 (firmware 2.7 and older) 6.5 - 2020-12-11
CVE-2020-15793 Siemens DESIGO INSIGHT 安全漏洞 — Desigo Insight 5.4 - 2020-10-15
CVE-2020-13174 Teradici Managament console 安全漏洞 — - Management Console 6.1 - 2020-08-11
CVE-2019-7393 CA Risk Authentication和CA Strong Authentication 信息泄露漏洞 — CA Strong Authentication 4.3 - 2019-05-28
CVE-2017-16775 Synology SSO Server 输入验证错误漏洞 — SSO Server 6.1 - 2019-04-01

CWE-1021（不当限制渲染UI层或帧） 是常见的弱点类别，本平台收录该类弱点关联的 130 条 CVE 漏洞。