CVE-2023-4432: Cockpit Cross-site Scripting vulnerability
Cockpit Cross-site Scripting vulnerability
Other sources
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
— MITRE
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit version 2.6.3 and prior. A patch is available at commit 2a93d391fbd2dd9e730f65d43b29beb65903d195 and anticipated to be part of version 2.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cockpit-hq/cockpitto a version that resolves this vulnerability.Fixed in 2.6.4Patch 2a93d391fbd2dd9e730f65d43b29beb65903d195
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4432?
The severity of CVE-2023-4432 is high.
How does CVE-2023-4432 impact GitHub repository cockpit-hq/cockpit?
CVE-2023-4432 impacts GitHub repository cockpit-hq/cockpit by enabling cross-site scripting (XSS) attacks.
What version of cockpit-hq/cockpit is affected by CVE-2023-4432?
Cockpit-hq/cockpit version 2.6.3 and prior is affected by CVE-2023-4432.
How can I fix CVE-2023-4432?
To fix CVE-2023-4432, update to version 2.6.4 or apply the patch available at commit 2a93d391fbd2dd9e730f65d43b29beb65903d195.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-4432?
The CWE ID for CVE-2023-4432 is CWE-79.