Security Resilience

CVE-2023-0759

Agentejo Cockpit ≤ 2.3.8

Public PoC
Published
09 February 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0034 26th percentile
Risk Priority 63 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-0759 is a high-severity Privilege Chaining (CWE-268) vulnerability in Agentejo Cockpit. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.

CWE(s)
CWE-268

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1010 Application Window Discovery Discovery
Adversaries may attempt to get a listing of open application windows.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2020-35847Same product: Agentejo Cockpit
CVE-2023-4433Same product: Agentejo Cockpit
CVE-2023-4451Same product: Agentejo Cockpit
CVE-2020-35846Same product: Agentejo Cockpit
CVE-2020-35131Same product: Agentejo Cockpit
CVE-2023-4196Same product: Agentejo Cockpit
CVE-2023-4321Same product: Agentejo Cockpit
CVE-2023-1160Same product: Agentejo Cockpit
CVE-2023-37650Same product: Agentejo Cockpit
CVE-2024-4825Same product: Agentejo Cockpit

Affected Assets

agentejo
cockpit
≤ 2.3.8

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 5 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 partial match
blocks

Least-privilege policy definition and enforcement directly limits unsafe privilege combinations while the control also addresses broader policy lifecycle activities.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
blocks

Access control policies can limit the combination of privileges that enable unsafe actions.

A.5.18 Access rights partial match
blocks

A.5.18's provisioning, review, SoD, and revocation steps (esp. c, f, i) directly block unsafe privilege/role combinations at assignment and change time, but leave a bounded remainder (e.g. runtime dynamic chaining, combinations arising from un-reviewed legacy rights, or non-identity-based privilege escalation) unaddressed by this clause alone.

A.5.19 Information security in supplier relationships partial match
removes
A.5.3 Segregation of duties partial match
blocks

A.5.3 directly requires determining and enforcing segregation of the very duties/roles whose unsafe combination is CWE-268, so well-implemented segregation stops the chained privilege from being exercisable; the bounded remainder is small organizations or sanctioned exceptions where segregation cannot be achieved and the clause itself falls back to monitoring/supervision instead.

A.5.5 Contact with authorities partial match
removes
A.7.2 Physical entry partial match
removes

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Ubuntu 22.04 (1 rule)
  • V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. blocks CWE-268
Ubuntu 24.04 (1 rule)
  • V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. blocks CWE-268
Windows 10 (1 rule)
  • V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. blocks CWE-268
Windows Server 2016 (1 rule)
  • V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. blocks CWE-268
Windows Server 2019 (1 rule)
  • V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. blocks CWE-268

References