CVE-2022-2818 Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit

Critical 9.8 Published 15 Aug 2022 Updated 3 Aug 2024

Attackers can access sensitive information due to improper removal before storage or transfer in Cockpit CMS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-2818?

CVE-2022-2818 is a critical vulnerability in cockpit-hq/cockpit, published on 15 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2.

Weakness: CWE-212

Which versions are affected by CVE-2022-2818?

2 open source packages ship an affected version, including cockpit-hq/cockpit. It affects 1 product.

Package	Affected	Fixed in
`cockpit-hq/cockpit` Packagist	All versions	`2.2.2`
`cockpit-hq/cockpit` Packagist	All versions	`2.2.2`

Products include Agentejo Cockpit.

How do I fix CVE-2022-2818?

Upgrade cockpit-hq/cockpit to 2.2.2 or later.

Is CVE-2022-2818 being exploited?

There is no known exploitation of CVE-2022-2818 in the wild and no public exploit code.

Sources

Also known as GHSA-8wj3-cpmr-8whp.