Insecure or unset HTTP headers - X-Frame Options
Description
The application uses the X-Frame Options header on the server responses as the only protection mechanism against clickjacking. This header is considered deprecated, since its protection can be bypassed using several iframe layers.
Impact
Embed the application in malicious frames.
Recommendation
- Disable the X-Frame Options from the server responses. - Define the frame_ancestors policy in the Content Security Policy header.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
⏱️ 30 minutes.
Score
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
Attack vector
N
Attack complexity
H
Attack requirements
N
Privileges required
N
User interaction
A
Confidentiality (VC)
N
Integrity (VI)
L
Availability (VA)
N
Confidentiality (SC)
N
Integrity (SI)
N
Availability (SA)
N
Threat 4.0
Exploit maturity
X
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N