GHSA-j4rj-fgcq-wmqp

Source

https://github.com/advisories/GHSA-j4rj-fgcq-wmqp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-j4rj-fgcq-wmqp/GHSA-j4rj-fgcq-wmqp.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-j4rj-fgcq-wmqp

Aliases

CVE-2025-7053

Published

2025-07-04T03:30:32Z

Modified

2025-07-04T13:42:13.681786Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Cockpit - Content Platform vulnerable to XSS through name or email argument names

Details

A vulnerability was found in Cockpit versions up to 2.11.3. This issue affects some unknown processing instances of the file /system/users/save. The manipulation of the arguments "name" or "email" leads to cross-site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 will address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted accordingly. A patch and new release were made available very quickly.

Database specific

{
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": "2025-07-04T03:15:23Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2025-07-04T13:02:40Z"
}

References

Affected packages

Packagist / cockpit-hq/cockpit

Package

Name: cockpit-hq/cockpit
Purl: pkg:composer/cockpit-hq/cockpit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.11.4

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.1.0

2.1.1

2.1.2

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.4.0

2.4.1

2.5.0

2.5.1

2.5.2

2.6.0

2.6.1

2.6.2

2.6.3

2.7.0

2.7.1

2.7.2

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.8.6

2.9.0

2.9.1

2.9.2

2.9.3

2.9.4

2.10.0

2.10.1

2.10.2

2.10.3

2.11.0

2.11.1

2.11.2

2.11.3