GitHub Advisoryadvisory · Packagist

GHSA-q76r-7p4q-mqpw Cockpit CMS Cross-Site Scripting vulnerability

MEDIUM Published 2024-02-29 Modified 2024-02-29 Official page ↗
Aliases
CVE-2024-2001
Ecosystem
Packagist
Packages
cockpit-hq/cockpit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2024-02-29

Affected packages

• Packagist cockpit-hq/cockpit: 2.7.0 (no fix yet)

Description

A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.

Related

Alias · CVE (1)

  • CVE-2024-2001 A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References