CVE-2020-35846

2020-12-3000:00:00

attackerkb.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

Recent assessments:

h00die at May 31, 2021 12:07pm UTC reported:

noSQL injection within the /auth/requestreset API. By sending JSON.generate({ 'user' => { '$func' => 'var_dump' } }) it causes the var_dump function to be called, which dumps all memory for the user object. This, in effect, allows for enumerating all usernames on the system. This can be combined with CVE-2020-35847 to eventually get an RCE.

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 5