CVE-2023-4451
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
A Cross-site Scripting (XSS) reflected vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to version 2.6.4 or later to mitigate this vulnerability.
Other vulnerabilities in cockpit-hq/cockpit
See all- CVE-2023-4432Medium
A Cross-site Scripting (XSS) vulnerability, reflected, exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4. An attacker can exploit this vulnerability to inject malicious scripts in the context of the victim's browser.
- CVE-2023-4196Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.3, allowing for the storage of malicious code.
- CVE-2023-4195High
A PHP Remote File Inclusion vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.3.
Original NVD description (English source)
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS