GHSA-q76r-7p4q-mqpw

ghsaUSosv

Cockpit CMS Cross-Site Scripting vulnerability

view advisory published 2024-02-29Licence: CC-BY-4.0

A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-2001US	medium5.4	0.32% (25th)	—	2024-02-29
A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicio…

references

External citations — patches, advisories, analysis.

https://github.com/Cockpit-HQ/CockpitPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2024-2001ADVISORY
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cockpit-cmsWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan