CVE-2021-32857 — Cross-site Scripting in Cockpit

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 61.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MicroweberAgentejo Cockpit
Timeline
PublishedFeb 21

Description

Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDagentejo/cockpit0.12.2
▶CVEListV5microweber/microweber0.12.2 — 0.12.2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8c8x-phvc-5p9w: Cockpit is a content management system that allows addition of content management functionality to any site↗2023-02-21
▶
CVEList
Cockpit vulnerable to Cross-site Scripting↗2023-02-20
▶
CVE-2021-32857 — Cross-site Scripting in Cockpit | cvebase