GHSA-m379-x4xc-38x9

rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-3167

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rdiffweb	< 2.4.1	2.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

rdiffweb prior to 2.4.1 is vulnerable to Improper Restriction of Rendered UI Layers or Frames. This allows attackers to perform clickjacking attacks that can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion. This issue has been patched in version 2.4.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-3167 advisory
https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428 web
https://github.com/advisories/GHSA-m379-x4xc-38x9 advisory
https://github.com/ikus060/rdiffweb package
https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-268.yaml web
https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c web