CRITICAL🇵🇱 Wersja polska

CVE-2020-10789

CVSS 9.8v3.1pub. 2020-03-25upd. 2024-11-21

openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • It Novum Openitcockpit

    APP
    It-Novum
    < 3.7.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2020-10788CRITICAL9.1PL ✓same product

openITCOCKPIT: Hardcodowany klucz API dla połączeń WebSocket

CVE-2019-15494CRITICAL9.8PL ✓same product

SSRF w openITCOCKPIT umożliwiający nieautoryzowany dostęp do zasobów wewnętrznych

CVE-2019-15490CRITICAL9.8PL ✓same product

Command Injection w openITCOCKPIT umożliwiający zdalne wykonanie kodu

CVE-2026-24893HIGH8.8same product

openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Communit...

CVE-2026-24891HIGH7.5same product

openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and...