CVE-2018-9302

CRITICAL 9.1CVE-2018-9302 · Published 02/05/2018 · updated 17/06/2026

In short

CVE-2018-9302 is a CRITICAL (CVSS 9.1) vulnerability affecting cockpit (getcockpit).
Chance of exploitation in the next 30 days (EPSS): 8.4%, higher than 95.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
cockpit getcockpit	`≥ 0.4.4, ≤ 0.5.5`	No fix yet

Description

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about version 0.13.0, which (surprisingly) is an earlier version than 0.4.4.

References

seclists.org/fulldisclosure/2018/May/10 · Exploit
exploit-db.com/exploits/44567 · Exploit

More vulnerabilities in cockpit

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free