Clickjacking Vulnerability
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5epss 0.9%
exploitation probability
0.9%top 43% of all CVEs
observed exploitation
nono source reports it
In short
Kiwi Syslog Server is missing a security header that prevents clickjacking attacks, where attackers trick users into clicking hidden buttons or links by overlaying a fake webpage on top of the real one.
Technical detail
The absence of the X-Frame-Options HTTP header allows the application to be embedded in iframes, enabling clickjacking attacks where an attacker overlays a transparent frame to hijack user interactions intended for the legitimate server. This requires user interaction and affects the confidentiality and integrity of user actions.
Summary generated and translated by AI from the official description.
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
SolarWinds · Kiwi Syslog Server