PT-2020-17485

CVE-2020-35848

Published

2020-12-30

Updated

2022-04-05

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Agentejo Cockpit versions prior to 0.11.2

Description The issue allows NoSQL injection via the newpassword function in the Controller/Auth.php file.

Recommendations For versions prior to 0.11.2, update to version 0.11.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the newpassword function in the Controller/Auth.php file until a patch is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Aheinze

Nikita Petrov

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers