CyberRota Analysis
AI-GeneratedAjenti versions up to 2.2.13 are vulnerable to a clickjacking attack due to the absence of anti-framing protections in the browser-facing login and administrative UI. This weakness allows attackers to potentially trick users into interacting with the UI without their consent, leading to unauthorized actions. Organizations using Ajenti for system management should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI start_response() without adding anti-framing protections such as X-Frame-Options or a Content-Security-Policy frame-ancestors restriction.