{"id":"UBUNTU-CVE-2021-3660","details":"Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an \u003ciFrame\u003e HTML entry. This may be used by a malicious website in clickjacking or similar attacks.","modified":"2025-10-24T04:49:54Z","published":"2022-03-10T17:42:00Z","upstream":["CVE-2021-3660"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-3660"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980688"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-3660"}],"affected":[{"package":{"name":"cockpit","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/cockpit@164-1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["151-1","156-1","157-1","158-1","160-1","161-1","162-1","163-1","164-1"],"ecosystem_specific":{"binaries":[{"binary_version":"164-1","binary_name":"cockpit"},{"binary_name":"cockpit-bridge","binary_version":"164-1"},{"binary_version":"164-1","binary_name":"cockpit-dashboard"},{"binary_name":"cockpit-docker","binary_version":"164-1"},{"binary_name":"cockpit-machines","binary_version":"164-1"},{"binary_name":"cockpit-networkmanager","binary_version":"164-1"},{"binary_name":"cockpit-packagekit","binary_version":"164-1"},{"binary_name":"cockpit-storaged","binary_version":"164-1"},{"binary_name":"cockpit-system","binary_version":"164-1"},{"binary_version":"164-1","binary_name":"cockpit-tests"},{"binary_name":"cockpit-ws","binary_version":"164-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3660.json"}},{"package":{"name":"cockpit","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/cockpit@215-1?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["202.1-1","204-1","206-1","207-1","208-1","210-1","211-1","212-1","213-1","214.1-1","215-1"],"ecosystem_specific":{"binaries":[{"binary_name":"cockpit","binary_version":"215-1"},{"binary_name":"cockpit-bridge","binary_version":"215-1"},{"binary_name":"cockpit-dashboard","binary_version":"215-1"},{"binary_name":"cockpit-machines","binary_version":"215-1"},{"binary_name":"cockpit-networkmanager","binary_version":"215-1"},{"binary_name":"cockpit-packagekit","binary_version":"215-1"},{"binary_name":"cockpit-pcp","binary_version":"215-1"},{"binary_name":"cockpit-storaged","binary_version":"215-1"},{"binary_name":"cockpit-system","binary_version":"215-1"},{"binary_name":"cockpit-tests","binary_version":"215-1"},{"binary_name":"cockpit-ws","binary_version":"215-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3660.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}