CVE-2018-9302

CRITICO 9.1CVE-2018-9302 · Published 02/05/2018 · updated 17/06/2026

In breve

CVE-2018-9302 è una vulnerabilità CRITICO (CVSS 9.1) che riguarda cockpit (getcockpit).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 8.4%, superiore al 95.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
cockpit getcockpit	`≥ 0.4.4, ≤ 0.5.5`	No fix yet

Description

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about version 0.13.0, which (surprisingly) is an earlier version than 0.4.4.

References

seclists.org/fulldisclosure/2018/May/10 · Exploit
exploit-db.com/exploits/44567 · Exploit

Altre vulnerabilità di cockpit

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free