Skip to main content

Tuleap Community Edition development and releases are no longer public. You have until September 30th to download packages and sources in Tuleap project. You can contact the team if you need further assistance.

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #7785 Vulnerable to clickjacking attack
    Infos
    #7785
    Thomas Gerbet (tgerbet)
    2015-03-04 16:22
    2015-01-21 14:55
    7789
    Details
    Vulnerable to clickjacking attack

    Tuleap is vulnerable to clickjacking attack (aka UI redress attack).

    Impact

    An attacker could trick an user into doing some actions like clicking on a button or filling a form and route informations to another page.
    CVSS2 score : 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

    Exploitation

    A proof of concept is attached. Put the URL you want to test instead of TULEAP_URL.

    References

    https://www.owasp.org/index.php/Clickjacking
    http://seclab.stanford.edu/websec/framebusting/framebust.pdf

    Other
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2015-01-22
    Attachments
    By Thomas Gerbet (tgerbet)
    (260 B)
    poc_clickjacking.html
    Proof of concept clickjacking
    References
    Referencing request #7785

    Artifact

    request #10223 Clickjacking protection can be bypassed on Internet Explorer or Edge
    rel #7520 7.10
    Display settings

    Follow-ups

    User avatar
    Yannis ROSSETTO (rossettoy)2015-01-22 13:27
    Merged in Tuleap 7.9.99.54
    • Status changed from Under implementation to Closed
    • Close date set to 2015-01-22