Unrestricted File Upload

2024-05-1606:19:08

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

unrestricted file upload

vulnerability

improper file upload checks

media api

compromise

system integrity

unauthorized access

data manipulation

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.7%

JSON

cockpit-hq/cockpit is vulnerable to Unrestricted File Upload. The vulnerability is due to an improper file upload checks within the /media/api POST endpoint which can be exploited to compromise the system’s integrity, allowing unauthorized access or data manipulation.

CPENameOperatorVersion
cockpit-hq/cockpitle2.6.3
cockpit-hq/cockpitle2.6.3

CPE	Name	Operator	Version
	cockpit-hq/cockpit	le	2.6.3
	cockpit-hq/cockpit	le	2.6.3

References

github.com/advisories/GHSA-vpj8-xfqc-jcv9

www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-dangerous-type-vulnerability-cockpit-cms