CVE-2023-0780 Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit
An attacker can bypass UI layer restrictions in Cockpit CMS, potentially enabling clickjacking or interface manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0780?
CVE-2023-0780 is a medium-severity vulnerability in cockpit-hq/cockpit, published on 11 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
Weakness: CWE-1021
Which versions are affected by CVE-2023-0780?
2 open source packages ship an affected version, including cockpit-hq/cockpit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cockpit-hq/cockpit Packagist | All versions | 2.3.9 |
cockpit-hq/cockpit Packagist | All versions | 2.3.9 |
Products include Agentejo Cockpit.
How do I fix CVE-2023-0780?
Upgrade cockpit-hq/cockpit to 2.3.9 or later.
Is CVE-2023-0780 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0780 exists.
Other vulnerabilities in cockpit-hq/cockpit
- CVE-2023-4195 PHP Remote File Inclusion in cockpit-hq/cockpit
- CVE-2024-4825 Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo
- CVE-2022-2818 Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit
- CVE-2020-35131 Code injection in n/a
- CVE-2020-35846 SQL injection in n/a
Sources
Also known as GHSA-gm7m-rqf8-jx4m.