CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
- Abstraction:Base
- Structure:Simple
- Status:Incomplete
- Release Date:2017-11-08
- Latest Modification Date:2026-04-30
Weakness Name
Improper Restriction of Rendered UI Layers or Frames
Description
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Common Consequences
Scope: Access Control
Impact: Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data
Notes: An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trick the user into changing privacy settings.