Cockpit < 2.11.4 XSS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(241956);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2025-7053");
  script_xref(name:"IAVA", value:"2025-A-0480-S");

  script_name(english:"Cockpit < 2.11.4 XSS");

  script_set_attribute(attribute:"synopsis", value:
"Cockpit is affected by a cross site scripting vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Cockpit running on the remote web server prior to 2.11.4. A vulnerability was found in Cockpit up to
2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The
manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading
to version 2.11.4 is able to address this issue. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.11.4");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Cockpit version 2.11.4 or later to address this issue");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-7053");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/11");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:agentejo:cockpit");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses : XSS");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cockpit_detect.nbin");
  script_require_keys("installed_sw/Cockpit");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'Cockpit');

var constraints = [
  {'fixed_version': '2.11.4'}
];

vcf::check_version_and_report(
  app_info: app_info,
  constraints: constraints,
  flags:{'xss':true},
  severity: SECURITY_WARNING
);