Lucene search

[email protected]CVE-2023-37650

HistoryJul 20, 2023 - 8:15 p.m.

CVE-2023-37650

2023-07-2020:15:10

CWE-352

[email protected]

web.nvd.nist.gov

cve-2023-37650

cross-site request forgery

csrf

admin portal

cockpit cms

security vulnerability

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

23.8%

JSON

A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.

CPENameOperatorVersion
agentejo:cockpitagentejo cockpitle2.5.2
agentejo:cockpitagentejo cockpiteq2.2.1
agentejo:cockpitagentejo cockpiteq0.8.0
agentejo:cockpitagentejo cockpiteq0.5.1
agentejo:cockpitagentejo cockpiteq0.9.2
agentejo:cockpitagentejo cockpiteq0.7.0
agentejo:cockpitagentejo cockpiteq0.8.10
agentejo:cockpitagentejo cockpiteq2.4.0
agentejo:cockpitagentejo cockpiteq0.9.0
agentejo:cockpitagentejo cockpiteq0.7.1

CPE	Name	Operator	Version
agentejo:cockpit	agentejo cockpit	le	2.5.2
agentejo:cockpit	agentejo cockpit	eq	2.2.1
agentejo:cockpit	agentejo cockpit	eq	0.8.0
agentejo:cockpit	agentejo cockpit	eq	0.5.1
agentejo:cockpit	agentejo cockpit	eq	0.9.2
agentejo:cockpit	agentejo cockpit	eq	0.7.0
agentejo:cockpit	agentejo cockpit	eq	0.8.10
agentejo:cockpit	agentejo cockpit	eq	2.4.0
agentejo:cockpit	agentejo cockpit	eq	0.9.0
agentejo:cockpit	agentejo cockpit	eq	0.7.1

Rows per page:

1-10 of 631

References

github.com/Cockpit-HQ/Cockpit/releases/tag/2.6.0

www.ghostccamm.com/blog/multi_cockpit_vulns/

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

23.8%

JSON

Related for CVE-2023-37650

osv2 veracode2 prion1 cvelist1 github1