CVE-2023-4432

MediumCVSS 6.1

Published: 19/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

41th percentile - higher than 41% of all known CVEs

Summary

A Cross-site Scripting (XSS) vulnerability, reflected, exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4. An attacker can exploit this vulnerability to inject malicious scripts in the context of the victim's browser.

Risk Assessment

This vulnerability may lead to session data theft or unauthorized access to information. Organizations should be aware of the risks associated with attackers exploiting this flaw.

Recommendation

It is recommended to upgrade to version 2.6.4 or later to mitigate this vulnerability. Additionally, implementing XSS protection mechanisms in web applications is advisable.

Original NVD description (English source)

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.