CVE-2025-43854CWE-1021

DIFY vulnerable to Clickjacking Attack

Low · published April 28, 2025

CVSS v4.0
2.3
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2025-04-28T15:58Z
EPSS history
Timeline
  • 28 APR 15:58Z
    DIFY vulnerable to Clickjacking Attack
    cvelistv5