Lucene search

MitreCVE-2020-10791

HistoryMar 25, 2020 - 2:15 p.m.

CVE-2020-10791

2020-03-2514:15:12

CWE-918

mitre

web.nvd.nist.gov

cve-2020-10791

app

plugin

grafanamodule

controller

grafanaconfigurationcontroller

ssrf

openitcockpit

test connection

testgrafanaconnection

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka testGrafanaConnection) of the Grafana Module.

Affected configurations

Nvd

Node

it-novumopenitcockpitRange<3.7.3

VendorProductVersionCPE
it-novumopenitcockpit*cpe:2.3:a:it-novum:openitcockpit:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
it-novum	openitcockpit	*	cpe:2.3:a:it-novum:openitcockpit::::::::

References

github.com/it-novum/openITCOCKPIT/commit/50722befae4cfedd0103f9b0ec2a7e22530b2385

openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

Related for CVE-2020-10791