PT-2024-18497 · Unknown · Cockpit Cms

Sergio Román Hurtado · Published 2024-02-29 · Updated 2024-02-29 · CVE-2024-2001

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.7.0

Description A Cross-Site Scripting issue in Cockpit CMS could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.

Recommendations For version 2.7.0, consider disabling the file upload feature until a patch is available to prevent exploitation of this issue. Restrict access to areas where file uploads are possible to minimize the risk of malicious JavaScript payload execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-2001

GHSA-Q76R-7P4Q-MQPW

Affected Products

Cockpit Cms

References · 9

• https://osv.dev/vulnerability/CVE-2024-2001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q76r-7p4q-mqpw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2001 · Security Note
• https://github.com/Cockpit-HQ/Cockpit · Note
• https://twitter.com/CVEnew/status/1763206825087062399 · Twitter Post
• https://t.me/cvenotify/72710 · Telegram Post
• https://twitter.com/incibe_cert/status/1763159468236329055 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1763326206101832018 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cockpit-cms · Note