PT-2020-17487 · Agentejo+1 · Cockpit+1

Passtheticket · Published 2020-12-30 · Updated 2025-12-26 · CVE-2020-35850

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cockpit version 234

Description A Server-Side Request Forgery (SSRF) issue was discovered. The vendor has stated that they do not think it is a big real-life issue. This issue is unrelated to the Agentejo Cockpit product.

Recommendations For version 234, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-00316

CVE-2020-35850

OESA-2024-1552

OESA-2024-1660

OESA-2024-1661

Affected Products

Cockpit

Red Os

References · 20

• 🔥 https://github.com/cockpit-project/cockpit/issues/15077 · Exploit
• 🔥 https://github.com/passtheticket/vulnerability-research/blob/main/cockpitProject/README.md · Exploit
• https://bdu.fstec.ru/vul/2026-00316 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35850 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1552 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35850 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35850 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1660 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35850 · Security Note
• https://osv.dev/vulnerability/OESA-2024-1661 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35850 · Vendor Advisory
• https://t.me/cvenotify/7962 · Telegram Post
• https://t.me/cibsecurity/21422 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-cockpit-cve-2020-35850-7.3 · Note