Clickjacking vulnerability in Clibo Manager
Clibo Manager, version 1.1.9.12.
INCIBE has coordinated the publication of 1 vulnerability of medium severity affecting Clibo Manager v1.1.9.12, a platform for managing the sale of season tickets, tickets and subscriber management, which has been discovered by David Padilla Alvarado.
This vulnerability has been assigned the following code, CVSS v3.1 base score, CVSS vector and vulnerability type CWE.
- CVE-2024-10454: CVSS v3.1: 6.1 | CVSS AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CWE-1021.
The vulnerability has been fixed by the Clibo Manager team in version 1.1.9.18.
CVE-2024-10454: clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Frame-Options server-side header. An attacker could overlay a transparent iframe to perform click hijacking on victims.
