CVE-2023-4196
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.3, allowing for the storage of malicious code.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 2.6.3 or later to mitigate this vulnerability.
Other vulnerabilities in cockpit-hq/cockpit
See all- CVE-2023-4451Medium
A Cross-site Scripting (XSS) reflected vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4.
- CVE-2023-4432Medium
A Cross-site Scripting (XSS) vulnerability, reflected, exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4. An attacker can exploit this vulnerability to inject malicious scripts in the context of the victim's browser.
- CVE-2023-4195High
A PHP Remote File Inclusion vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.3.
Original NVD description (English source)
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS