PT-2025-27857 · Cockpit · Cockpit

Matans · Published 2025-07-04 · Updated 2025-07-20 · CVE-2025-7053

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Cockpit versions up to 2.11.3

Description: A issue was found in the processing of the file /system/users/save, where the manipulation of the argument name or email leads to cross-site scripting. The attack may be initiated remotely. It is estimated that this issue may affect some unknown number of devices, but the exact number is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations: For Cockpit versions up to 2.11.3, upgrade to version 2.11.4 to address this issue. As a temporary workaround, consider restricting access to the /system/users/save file until the upgrade is applied. Avoid using the name and email arguments in the affected processing until the issue is resolved.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2025-7053

GHSA-J4RJ-FGCQ-WMQP

Affected Products

Cockpit

References · 11

• 🔥 https://vuldb.com/?submit.605594 · Exploit
• https://github.com/Cockpit-HQ/Cockpit/commit/bdcd5e3bc651c0839c7eea807f3eb6af856dbc76 · Patch
• https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.11.4 · Patch
• https://osv.dev/vulnerability/GHSA-j4rj-fgcq-wmqp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7053 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7053 · Vendor Advisory
• https://github.com/Cockpit-HQ/Cockpit · Note
• https://vuldb.com/?id.314819 · Note
• https://twitter.com/jmdevlabs/status/1947078774752788988 · Twitter Post
• https://vuldb.com/?ctiid.314819 · Note
• https://twitter.com/VulmonFeeds/status/1940985668655522167 · Twitter Post