Cockpit prior to 0.12.0 NoSQL injection in /auth/check

CVE-2020-35846 is a vulnerability discovered in Cockpit CMS, an open-source content management system, that allows NoSQL injection attacks via the Controller/Auth.php check function. In some configurations, the vulnerabilities could allow an unauthenticated remote attacker to execute code on a cockpit server, especially those running MongoLite.

Mitigation / Precaution

In order to patch this vulnerability, please install the official patch made by the vendor available for supported, vulnerable instances.

Written by

Anandhu K A

Lead Engineer

With a profound understanding of product development, Anandhu plays a pivotal role in crafting cutting-edge solutions that cater to the evolving security needs of digital applications. His expertise, deeply rooted in both engineering and security, makes him an essential component of Beagle Security's mission