What is GHSA-xcq3-7pf3-5jvc?

GHSA-xcq3-7pf3-5jvc is a security advisory published by GitHub Security Advisories with Critical severity. Cockpit PHP Remote File Inclusion vulnerability

Which CVE IDs does GHSA-xcq3-7pf3-5jvc cover?

GHSA-xcq3-7pf3-5jvc covers the following CVE IDs: CVE-2023-4195. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xcq3-7pf3-5jvc?

GHSA-xcq3-7pf3-5jvc has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

Which products are affected by GHSA-xcq3-7pf3-5jvc?

GHSA-xcq3-7pf3-5jvc affects 1 product, including: composer/cockpit-hq/cockpit:\u003c 2.6.3.

GHSA-xcq3-7pf3-5jvcCriticalCVSS 9.9

Cockpit PHP Remote File Inclusion vulnerability

Vendor

GitHub Security Advisories

Published

August 6, 2023

Last Modified

November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-4195 →

📋 Description

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Users may upload php files through the system file upload utility to obtain remote code execution.

🎯 Affected products1

composer/cockpit-hq/cockpit:< 2.6.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-4195
https://github.com/cockpit-hq/cockpit/commit/800c05f1984db291769ffa5fdfb1d3e50968e95b
https://huntr.dev/bounties/0bd5da2f-0e29-47ce-90f3-06518656bfd6
https://github.com/advisories/GHSA-xcq3-7pf3-5jvc