Cockpit CMS Cross-Site Scripting Vulnerability in cockpit-hq/cockpit
Summary
CVE-2024-2001: Cockpit CMS Cross-Site Scripting vulnerability. Affects cockpit-hq/cockpit versions 2.7.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cockpit CMS is an open-source content management system that provides a user-friendly interface for managing website content. It is widely used for its simplicity and flexibility. The vulnerability affects version 2.7.0 of Cockpit CMS. This vulnerability allows an authenticated user to upload an infected PDF file and store a malicious JavaScript payload. When the file is uploaded, the payload is executed, leading to a Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The Cross-Site Scripting vulnerability in Cockpit CMS version 2.7.0 enables an authenticated user to upload a PDF file containing a malicious JavaScript payload. This payload is stored within the file and executed when the file is uploaded. As a result, an attacker can inject arbitrary code into the website, potentially compromising user data, performing unauthorized actions, or defacing the website. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to apply the official fix provided by the developers by updating to the latest version of Cockpit CMS.
Conclusion
The Cross-Site Scripting vulnerability in Cockpit CMS version 2.7.0 poses a moderate risk to websites using this content management system. It allows an authenticated user to upload a PDF file containing a malicious JavaScript payload, leading to potential attacks and unauthorized access. To mitigate this vulnerability, it is crucial to update Cockpit CMS to the latest version that includes the necessary security patches. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cockpit-hq/cockpit →
FAQ
Cockpit CMS is an open-source content management system that provides a user-friendly interface for managing website content. It is known for its simplicity and flexibility.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing unauthorized actions.
This vulnerability occurs due to a lack of proper input sanitization and validation when handling uploaded PDF files in Cockpit CMS. It allows an authenticated user to upload a PDF file containing a malicious JavaScript payload, which is then executed when the file is uploaded.
The potential consequences of this vulnerability include unauthorized access to user data, manipulation of website content, and the execution of arbitrary code on the affected website. This can lead to data breaches, compromised user accounts, and defacement of the website.
Yes, the developers of Cockpit CMS have released a fix for this vulnerability in a subsequent version. Users are advised to update their installations to the latest version, which includes the necessary security patches.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-hq/cockpit.
