Stackrox: missing http security headers allows for clickjacking in web ui

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

不当限制渲染UI层或帧

Red Hat stackrox 安全漏洞

Red Hat stackrox是美国红帽（Red Hat）公司的一个全生命周期的 Kubernetes 安全解决方案。允许您检测、管理和缓解安全风险（例如错误配置）以及漏洞 （CVE）。 Red Hat stackrox 存在安全漏洞，该漏洞源于HTTP标头丢失，导致存在点击劫持漏洞。

N/A

N/A