GHSL-2021-1035: Cross-Site Scripting (XXS) in Cockpit Next - CVE-2021-32857
Published Apr 5, 2022
·Updated
Bad HTML sanitization in htmleditor.js may lead to cross-site scripting (XSS) issues.
Affected Software
1 affected component
Cockpit Project Cockpit Next
Event History
Apr 5, 2022
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
What component should be reviewed for exposure?
The issue is in htmleditor.js, where insufficient HTML sanitization can allow cross-site scripting.
2
What remediation information is available?
The provided references include commit 0c6628cbff3e49bc317c97b03a4666b3a75f76cc in the Cockpit repository. No affected or fixed release versions are provided.