GitHub Advisoryadvisory · Packagist

GHSA-vpj8-xfqc-jcv9 Cockpit CMS contains an arbitrary file upload vulenrability

CRITICAL Published 2024-05-14 Modified 2024-05-14 Official page ↗
Aliases
CVE-2024-4825
Ecosystem
Packagist
Packages
cockpit-hq/cockpit
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2024-05-14

Affected packages

• Packagist cockpit-hq/cockpit: < 2.7.0 → fixed in 2.7.0

Description

A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure.

Related

Alias · CVE (1)

  • CVE-2024-4825 A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References