漏洞描述
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
swarm.ptsecurity.comhttps://swarm.ptsecurity.com/rce-cockpit-cms/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-35846↗getcockpit.comhttps://getcockpit.com/↗github.comhttps://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466↗github.comhttps://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59af↗