CVE-2023-1313 Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit
Attackers can upload malicious files to execute arbitrary code on Cockpit CMS instances, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1313?
CVE-2023-1313 is a high-severity vulnerability in cockpit-hq/cockpit, published on 10 Mar 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
Weakness: CWE-434
Which versions are affected by CVE-2023-1313?
2 open source packages ship an affected version, including cockpit-hq/cockpit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cockpit-hq/cockpit Packagist | All versions | 2.4.1 |
cockpit-hq/cockpit Packagist | All versions | 2.4.1 |
Products include Agentejo Cockpit.
How do I fix CVE-2023-1313?
Upgrade cockpit-hq/cockpit to 2.4.1 or later.
Is CVE-2023-1313 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1313 exists.
Other vulnerabilities in cockpit-hq/cockpit
- CVE-2023-4195 PHP Remote File Inclusion in cockpit-hq/cockpit
- CVE-2024-4825 Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo
- CVE-2022-2818 Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit
- CVE-2020-35131 Code injection in n/a
- CVE-2020-35846 SQL injection in n/a
Sources
Also known as GHSA-6x8f-x6qw-qwx3.