Actions
Bug #14648
closedNessus reports Clickjacking vulnerability
Description
When scanning our environment with Nessus, the report came back that our Katello servers are vulnerable to Clickjacking on the URLs listed below:
http://<capsule server>/pub/
https://<capsule server>/pub/
https://<capsule server>/
https://<capsule server>:8443/pub/
Is it possible to add a X-Frame-Options response header in all content responses? If so, where should this be done at?
Thanks for any help you can give with this.
Brian
Updated by Dominic Cleal over 8 years ago
- Project changed from Foreman to Katello
- Category deleted (
Web Interface)
Updated by Justin Sherrill about 8 years ago
- Tracker changed from Support to Bug
- Category set to Installer
- Status changed from New to Need more information
- Difficulty set to medium
Likely you'd just add
Header always append X-Frame-Options SAMEORIGIN
to /etc/httpd/conf.d/05-foreman-ssl.conf
and bounce apache. We should add this to the installer. Does this make Nessus happy?
Updated by Justin Sherrill about 8 years ago
- Translation missing: en.field_release set to 166
Updated by Justin Sherrill about 8 years ago
- Status changed from Need more information to Rejected
Actions