PT-2020-12326 · Openitcockpit · Openitcockpit

Dejan Zelic · Published 2020-03-20 · Updated 2020-03-25 · CVE-2020-10792

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openITCOCKPIT versions 3.7.2 and earlier

Description The issue allows remote attackers to configure certain options by manipulating the HTTP Host header with specific keywords. This can be achieved by placing a hostname containing dev or staging in the header.

Recommendations For openITCOCKPIT versions 3.7.2 and earlier, as a temporary workaround, consider restricting access to configure the self::DEVELOPMENT or self::STAGING options until a patch is available. Avoid using hostnames containing dev or staging in the HTTP Host header to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-10792

Affected Products

Openitcockpit

References · 5

• https://github.com/it-novum/openITCOCKPIT/commit/719410b9ffff7d7b29dba7aad58faceb5eff789f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-10792 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10792 · Vendor Advisory
• https://t.me/cvenotify/1965 · Telegram Post
• https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released · Note