{"id":"CVE-2020-35850","aliases":["EUVD-2020-23505","GHSA-3mxq-x62m-9mvp","OESA-2024-1552","OESA-2024-1660","OESA-2024-1661"],"status":"disputed","title":"** DISPUTED ** An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is...","description":"An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \"I don't think [it] is a big real-life issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01664,"percentile":0.77021,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2020-12-30T01:27:02Z","modified":"2026-10-20T10:54:20Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP1","package":"cockpit","fixed_in":["178-12.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"cockpit","fixed_in":["178-12.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"cockpit","fixed_in":["178-14.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"cockpit","fixed_in":["178-14.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"cockpit","fixed_in":["178-15.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"cockpit","fixed_in":["178-15.oe2203sp3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"178-12.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"178-12.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"178-14.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"178-14.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"178-15.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"178-15.oe2203sp3"}]}]}],"products":[{"vendor":"cockpit-project","product":"cockpit"}],"references":[{"url":"https://github.com/passtheticket/vulnerability-research/blob/main/cockpitProject/README.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/cockpit-project/cockpit/issues/15077","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35850","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3mxq-x62m-9mvp"},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1552","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1660","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1661","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-35850","description":"An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \"I don't think [it] is a big real-life issue.","status":"disputed","published":"2020-12-30T01:27:02Z","modified":"2024-08-04T17:16:13.08Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-23505","description":"An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \"I don't think [it] is a big real-life issue.","status":"published","published":"2020-12-30T01:27:02Z","modified":"2024-08-04T17:16:13Z","updated_at":"2026-11-03T03:07:04.595509Z"}],"ghsa":[{"id":"GHSA-3mxq-x62m-9mvp","title":"** DISPUTED ** An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is...","description":"** DISPUTED ** An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \"I don't think [it] is a big real-life issue.\"","status":"published","published":"2022-05-24T17:37:48Z","modified":"2024-03-30T05:01:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:55:45.740984Z"}],"nvd":[{"id":"CVE-2020-35850","description":"An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \"I don't think [it] is a big real-life issue.","status":"disputed","published":"2020-12-30T02:15:12.68Z","modified":"2026-06-17T03:14:27.757Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35850","description":"An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \"I don't think [it] is a big real-life issue.","status":"published","published":"2020-12-30T02:15:12.68Z","modified":"2026-10-20T10:54:20.194262613Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"OESA-2024-1552","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\r\n\r\nAn SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \u0026quot;I don\u0026apos;t think [it] is a big real-life issue.(CVE-2020-35850)","status":"published","published":"2024-05-10T11:07:00Z","modified":"2026-08-18T01:18:25.606055098Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1660","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\r\n\r\nAn SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \u0026quot;I don\u0026apos;t think [it] is a big real-life issue.(CVE-2020-35850)","status":"published","published":"2024-05-24T11:07:07Z","modified":"2026-08-18T01:17:22.858902602Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1661","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\r\n\r\nAn SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states \u0026quot;I don\u0026apos;t think [it] is a big real-life issue.(CVE-2020-35850)","status":"published","published":"2024-05-24T11:07:07Z","modified":"2026-08-18T01:17:22.402106774Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"}]}}