Critical severity · published May 2, 2018
CVE-2018-9302
SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts…
9.1
CVSS
8.4%
EPSS
No
On KEV
Description
SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14611, which was about version 0.13.0, which (surprisingly) is an earlier version than 0.4.4.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.4% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Cockpit · Getcockpit
0.4.4 through 0.5.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-9302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-9302
Exploit
http://seclists.org/fulldisclosure/2018/May/10
Exploit
https://www.exploit-db.com/exploits/44567/
More from Cockpit
5.4
CVE-2018-11471
Cockpit 0.5.5 has XSS via a collection, form, or region