CVE-2022-3167: rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames
(updated )
rdiffweb prior to 2.4.1 is vulnerable to Improper Restriction of Rendered UI Layers or Frames. This allows attackers to perform clickjacking attacks that can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion. This issue has been patched in version 2.4.1.
References
- github.com/advisories/GHSA-m379-x4xc-38x9
- github.com/ikus060/rdiffweb
- github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428
- github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-268.yaml
- huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c
- nvd.nist.gov/vuln/detail/CVE-2022-3167
Detect and mitigate CVE-2022-3167 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →