CVE-2024-4825: Cockpit CMS contains an arbitrary file upload vulenrability
A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure.
Published May 14, 2024
Affected packages
cockpit-hq/cockpit
- Ecosystem
- Composer (PHP)
- Affected
- < 2.7.0
- Fixed in
- 2.7.0
- Check
composer show cockpit-hq/cockpit
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology