HIGH8.3

GHSA-rmgx-3w4r-xcfp

Cockpit Cross-site Scripting vulnerability

Details

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit version 2.6.3 and prior. A patch is available at commit 2a93d391fbd2dd9e730f65d43b29beb65903d195 and anticipated to be part of version 2.6.4.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/cockpit-hq/cockpit

Introduced in: 0

No fixed version published yet for cockpit-hq/cockpit (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-4432[ADVISORY]
https://github.com/cockpit-hq/cockpit/commit/2a93d391fbd2dd9e730f65d43b29beb65903d195[WEB]
https://github.com/cockpit-hq/cockpit[PACKAGE]
https://huntr.dev/bounties/69684663-6822-41ff-aa05-afbdb8f5268f[WEB]