CVE-2020-14408

2020-06-1720:15:00

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.1%

JSON

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page’s content, creating a Reflected XSS attack vector.

CPENameOperatorVersion
cockpiteq0.7.2
cockpiteq0.10.2
cockpiteq0.9.2
cockpiteq0.9.3
cockpiteq0.7.1
cockpiteq0.10.1
cockpiteq0.10.0

Name	Operator	Version
cockpit	eq	0.7.2
cockpit	eq	0.10.2
cockpit	eq	0.9.2
cockpit	eq	0.9.3
cockpit	eq	0.7.1
cockpit	eq	0.10.1
cockpit	eq	0.10.0

References

github.com/agentejo/cockpit/issues/1310