GitHub Advisoryadvisory · Packagist

GHSA-xcq3-7pf3-5jvc Cockpit PHP Remote File Inclusion vulnerability

CRITICAL Published 2023-08-06 Modified 2023-08-09 Official page ↗
Aliases
CVE-2023-4195
Ecosystem
Packagist
Packages
cockpit-hq/cockpit
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Weaknesses
CWE-98
Reviewed
2023-08-09

Affected packages

• Packagist cockpit-hq/cockpit: < 2.6.3 → fixed in 2.6.3

Description

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Users may upload php files through the system file upload utility to obtain remote code execution.

Related

Alias · CVE (1)

  • CVE-2023-4195 PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. vulnerability

Weakness · CWE (1)

  • CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program weakness

References