Threats tagged 'ghsa-7gf3-cfh5-c772'

Cockpit CMS versions 2.12.0 up to but not including 2.14.1 disable TLS certificate verification in the cron.php web worker restart request. This improper certificate validation allows network attackers performing man-in-the-middle attacks on the outbound connection to the site URL to present any certificate and capture the worker token. The vulnerability has a low severity rating with a CVSS score of 2.3.