Cross Frame Scripting (XFS) hides a legitimate website in an iframe. User unknowingly interacts with the iframe white interacting with the UI from another domain.

Remediation

Configure Content Security Policy and disallow framing.

Metadata

• Severity: low
• Slug: cross-frame-scripting

CWEs

• 1021: Improper Restriction of Rendered UI Layers or Frames

OWASP

• A05:2021: Security Misconfiguration