Every CVE Search/ Get API key

CVE-2021-3660

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to...

4.3 MediumFix available

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.26%Up 0.4 points since Mar 8, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Record
CVE-2021-3660
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-1021
Updated
2026-11-02
CVE List No score

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Record
CVE-2021-3660
Weakness
CWE-1021
Updated
2026-11-02
EUVDEUVD-2021-26955 No score

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Record
EUVD-2021-26955
Updated
2026-11-03
GitHub AdvisoriesGHSA-5m9v-2hhc-h2wj 4.3

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to...

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Record
GHSA-5m9v-2hhc-h2wj
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-1021
Updated
2026-11-02
OSV 4.3

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Record
CVE-2021-3660
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3660 4.3

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Record
DEBIAN-CVE-2021-3660
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2022:2008 7.5

Red Hat Security Advisory: cockpit security, bug fix, and enhancement update

Record
RHSA-2022:2008
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRLSA-2022:2008 7.5

Moderate: cockpit security, bug fix, and enhancement update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

The following packages have been upgraded to a later upstream version: cockpit (264.1). (BZ#1984902, BZ#1992620, BZ#2004041, BZ#2008208)

Security Fix(es):

  • cockpit: authenticates with revoked certificates (CVE-2021-3698)

  • cockpit: pages vulnerable to clickjacking (CVE-2021-3660)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:2008
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3660 4.3

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Record
UBUNTU-CVE-2021-3660
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVALSA-2022:2008 No score

Moderate: cockpit security, bug fix, and enhancement update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

The following packages have been upgraded to a later upstream version: cockpit (264.1). (BZ#1984902, BZ#1992620, BZ#2004041, BZ#2008208)

Security Fix(es):

  • cockpit: authenticates with revoked certificates (CVE-2021-3698)

  • cockpit: pages vulnerable to clickjacking (CVE-2021-3660)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:2008
Updated
2026-11-02
OSVMGASA-2021-0467 No score

Updated cockpit packages fix security vulnerability

Restrict frame embedding to same origin

Record
MGASA-2021-0467
Updated
2026-11-02
OSVOESA-2021-1359 No score

cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.

Security Fix(es):

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an HTML entry. This may be used by a malicious website in clickjacking or similar attacks.(CVE-2021-3660)

Record
OESA-2021-1359
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cockpit
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit-bridge
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit-doc
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit-system
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit-ws
AlmaLinux:8
 before 264.1-1.el8
264.1-1.el8
cockpit
Debian:12
 before 254-1
254-1
cockpit
Debian:13
 before 254-1
254-1
cockpit
Debian:14
 before 254-1
254-1
cockpit
Mageia:8
 before 254-1.mga8
254-1.mga8
cockpit
openEuler:20.03-LTS-SP1
 before 178-9.oe1
178-9.oe1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
cockpit
openEuler:20.03-LTS-SP2
 before 178-9.oe1
178-9.oe1
cockpit
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-bridge
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-doc
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-system
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit-ws
Red Hat:enterprise_linux:8::baseos
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit
Rocky Linux:8
 before 0:264.1-1.el8
0:264.1-1.el8
cockpit
Ubuntu:18.04:LTS
 All versions, plus listed versions
151-1156-1157-1158-1160-1
Show 4 moreShow less
161-1162-1163-1164-1
 None known
cockpit
Ubuntu:20.04:LTS
 All versions, plus listed versions
202.1-1204-1206-1207-1208-1
Show 6 moreShow less
210-1211-1212-1213-1214.1-1215-1
 None known

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3660 is a medium vulnerability (CVSS 4.3) in Cockpit-hq Cockpit, published September 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in cockpit 264.1-1.el8.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open