GHSA-8wj3-cpmr-8whpHighCVSS 8.8

Cockpit Content Platform vulnerable to 2FA bypass

Published
August 16, 2022
Last Modified
July 21, 2023

🔗 CVE IDs covered (1)

CVE-2022-2818 →

📋 Description

Cockpit Content Platform through version 2.2.1 is vulnerable to a two-factor authentication (2FA) bypass. The 2FA secret is disclosed in a JWT token after user logs into their account, allowing an attacker to bypass the 2FA code. A patch is available on the develop branch and is expected to be part of version 2.2.2.

🎯 Affected products1

  • composer/cockpit-hq/cockpit:<= 2.2.1

🔗 References (4)