Cockpit Project maintains a focused web-based systems-administration and remote-management interface for Linux systems that occupies a specialized niche in server management tooling. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cockpit Project over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-3804HIGH It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a s | Mar 26, 2019 | 7.5 | 26 | NO | NO |
CVE-2021-3698HIGH A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows cl | Mar 10, 2022 | 7.5 | 25 | NO | NO |
CVE-2020-35850MEDIUM An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states "I don't think [it] is a big real- | Dec 30, 2020 | 6.5 | 22 | NO | NO |
CVE-2021-3660MEDIUM Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML ent | Mar 10, 2022 | 4.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cockpit Project.
Media articles that mention a CVE ID that affects a product developed by Cockpit Project — matched by CVE ID, not by vendor name.