CVE-2024-2947CWE-77

Cockpit: command injection when deleting a sosreport with a crafted name

High · published March 28, 2024

CVSS v3.1
7.3
EPSS
1%
Percentile
67.7
In the wild
Unconfirmed
What it is

A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01191 · 67.7th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2024-03-28T18:31Z
EPSS history
Timeline
  • 28 MAR 18:31Z
    Cockpit: command injection when deleting a sosreport with a crafted name
    cvelistv5