Moderate severityNVD Advisory· Published Feb 29, 2024· Updated Aug 1, 2024

Cross-Site Scripting vulnerability in Cockpit CMS

CVE-2024-2001

Description

A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

ghsa-coords
pkg:composer/cockpit-hq/cockpit
Cockpit CMS/Cockpit CMSv5
Range: 2.7.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-q76r-7p4q-mqpwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-2001ghsaADVISORY
www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cockpit-cmsghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000