CVE-2024-2001: Cockpit CMS Cross-Site Scripting vulnerability

February 29, 2024

A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.

References

github.com/Cockpit-HQ/Cockpit
github.com/advisories/GHSA-q76r-7p4q-mqpw
nvd.nist.gov/vuln/detail/CVE-2024-2001
www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cockpit-cms

Code Behaviors & Features

Detect and mitigate CVE-2024-2001 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →