Insufficient default settings for security relevant HTTP response headers

Detail name	Value
Changelog Number	12247
Type	Bug
Status	Resolved
Affected Versions	Exasol 6.2.0, Exasol 7.0.0, Exasol 7.1.beta1
Fix Versions	Exasol 7.1.0, Exasol 6.2.15, Exasol 7.0.10
Resolution Date	2021-06-05

Vulnerability

Due to insufficient defaults being used for some security-relevant HTTP response headers, Exaoperaton was vulnerable to clickjacking attacks.

If a user that is logged into Exaoperation would interact with a malicious website, the website could interact with Exaoperation using the users credentials.

Workaround

We recommend an immediate update to remedy the issue.

Additionally, we recommend to only log into Exaoperation when needed and log out afterwards or use a secondary browser profile that is only used to interact with Exaoperation.

Fix

The relevant default settings for HTTP response headers were strengthened to align with security best practices. Additionally, more defenses against XSS attacks were implemented.