CVE-2020-35847

2020-12-3000:00:00

attackerkb.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

Recent assessments:

h00die at May 31, 2021 12:11pm UTC reported:

Similar to CVE-2020-35846, this is a noSQL injection using the var_dump function to dump all memory for the password reset tokens. The vulnerability is within the /auth/requestreset When combined with CVE-2020-35846, its possible to dump all users and their password reset tokens. With this, a successful password reset of the admin user is possible. Once logged in, using the /accounts/find API, a command injection vulnerability is achieved although there was no CVE assigned to this.

Assessed Attacker Value: 0
Assessed Attacker Value: 0Assessed Attacker Value: 0