Cross-Site Scripting (XSS)

2023-08-1803:00:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cockpit

cockpit-hq

vulnerable

cross-site scripting

attacks

user input

templates

authenticated

attacker

javascript code

executed

page

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.0%

JSON

cockpit-hq/cockpit is vulnerable to Cross-Site Scripting (XSS) attacks. The vulnerability occurs because the library does not properly escape user input when rendering templates, allowing an authenticated attacker to inject malicious JavaScript code into a Cockpit page, which would then be executed by users who view the page.