Following links are vulnerable to clickjacking
Low
S
Semrush
Submitted None
Actions:
Reported by
karma1
Vulnerability Details
Technical details and impact analysis
> NOTE! Thanks for submitting a report! Please replace *all* the [square] sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report!
**Summary:** [The below listed links, dont have X-FRAME-OPTIONS set to DENY or SAMEORIGIN and they are vulnerable to clickjacking]
**Description:** [The following url can be easily vulnerable to clickjacking]
**Browsers Verified In:**
* [Firefox V56]
**Steps To Reproduce:** [add details for how we can reproduce the issue]
1. [Run below code from browser and you will see listed links are vulnerable to clickjacking attack]
2. [<!DOCTYPE html>
<html>
<frameset cols="25%,*,25%">
<frame src="https://www.semrush.com/?l=us">
<frame src="https://www.semrush.com/academy/">
<frame src="https://www.semrush.com/ranking-factors/">
</frameset>
</html>]
**Following links are vulnerable to clickjacking**
+ https://www.semrush.com/semrush-opensearch.xml
+ https://www.semrush.com/academy/
+ https://www.semrush.com/ranking-factors/
+ https://www.semrush.com/manifest.json
+ https://www.semrush.com/?l=us
+ https://www.semrush.com/blog/
+ https://www.semrush.com/
+ https://www.semrush.com/prices/
+ https://www.semrush.com/.
+ https://www.semrush.com/.?l=us
**Supporting Material/References:**
* Screenshot is attached with ticket
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
UI Redressing (Clickjacking)