Webmin / Bugs / #4829 Webmin Vulnerable to ClickJacking attack

#4829 Webmin Vulnerable to ClickJacking attack

Milestone: 1.810

Status: open

Owner: nobody

Labels: security (5)

Priority: 9

Updated: 2016-09-30

Created: 2016-09-30

Creator: sushil

Private: No

Hi Team,

I have identified that webmin is vulnerable to clickjacking attack, where an attacker might open the webmin in any html IFRAME tag and hijacks the user clicks.

This may allow an attacker to use the webmin as a source to steal sensitive information like credentials which a user might be entering to log in to webmin and use these credentials to log in to Webmin.

I also have fix and where to apply this fix.

Let me know if any concern

Discussion

Jamie Cameron - 2016-09-30

Yes, please provide more details. However, webmin should block framing itself by default.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Webmin Vulnerable to ClickJacking attack

A web-based interface for system administration of UNIX

Group

Searches

Help

#4829 Webmin Vulnerable to ClickJacking attack

Discussion