DRUPAL-CONTRIB-2021-018 This project is related to Opigno LMS distribution.
The Opigno LMS module fails to set X-Frame-Options headers, allowing attackers to perform clickjacking attacks against users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2021-018?
DRUPAL-CONTRIB-2021-018 is a vulnerability in drupal/opigno_learning_path, published on 23 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very flexible way the differents steps of a training in Opigno LMS.
The module does not set X-Frame-Options and blocks ability of other modules (e.g Security Kit) to add them, leaving it vulnerable to Clickjacking.
Which versions are affected by DRUPAL-CONTRIB-2021-018?
Linux distribution packages (1)
drupal/opigno_learning_path Packagist:https://packages.drupal.org/8 | All versions | 1.11.0 |
How do I fix DRUPAL-CONTRIB-2021-018?
Apply the vendor's patch.
Is DRUPAL-CONTRIB-2021-018 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2021-018 in the wild and no public exploit code.