CVE-2024-4825: Cockpit CMS contains an arbitrary file upload vulenrability

May 14, 2024

A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure.

References

github.com/Cockpit-HQ/Cockpit
github.com/advisories/GHSA-vpj8-xfqc-jcv9
nvd.nist.gov/vuln/detail/CVE-2024-4825
www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-upload-file-dangerous-type-vulnerability-cockpit-cms

Code Behaviors & Features

Detect and mitigate CVE-2024-4825 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →