CWE-1021—Improper Restriction of Rendered UI Layers or Frames
PUBLISHEDweakness record
released 2017-11-08 · last modified 2026-04-30
Metadata
- CWE ID:
- CWE-1021
- Abstraction:
- Base
- Structure:
- Simple
- Status:
- Incomplete
- Release Date:
- 2017-11-08
- Latest Modification Date:
- 2026-04-30
Weakness Name
Improper Restriction of Rendered UI Layers or Frames
Description
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Common Consequences
- Scope:
- Access Control
- Impact:
- Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Application Data, Modify Application Data
- Notes:
- An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trick the user into changing privacy settings.
