1862
Reference Description
CVE-2017-7440 E-mail preview feature in a desktop application allows clickjacking attacks via a
crafted e-mail message
https://www.cve.org/CVERecord?id=CVE-2017-7440
CVE-2017-5697 Hardware/firmware product has insufficient clickjacking protection in its web
user interface
https://www.cve.org/CVERecord?id=CVE-2017-5697
CVE-2017-4015 Clickjacking in data-loss prevention product via HTTP response header.
https://www.cve.org/CVERecord?id=CVE-2017-4015
CVE-2016-2496 Tapjacking in permission dialog for mobile OS allows access of private storage
using a partially-overlapping window.
https://www.cve.org/CVERecord?id=CVE-2016-2496
CVE-2015-1241 Tapjacking in web browser related to page navigation and touch/gesture
events.
https://www.cve.org/CVERecord?id=CVE-2015-1241
CVE-2017-0492 System UI in mobile OS allows a malicious application to create a UI overlay of
the entire screen to gain privileges.
https://www.cve.org/CVERecord?id=CVE-2017-0492
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
103 Clickjacking
181 Flash File Overlay
222 iFrame Overlay
504 Task Impersonation
506 Tapjacking
587 Cross Frame Scripting (XFS)
654 Credential Prompt Impersonation
References
[REF-35]Andrew Horton. "Clickjacking For Shells". < https://www.exploit-db.com/docs/17881.pdf >.
[REF-36]OWASP. "Clickjacking - OWASP". < https://owasp.org/www-community/attacks/
Clickjacking >.2023-04-07.
[REF-37]Internet Security. "SecTheory". < https://www.sectheory.com/clickjacking.htm
>.2023-04-07.
[REF-38]W3C. "Content Security Policy Level 3". < https://w3c.github.io/webappsec-csp/ >.
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
Weakness ID : 1022
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access