CVE-2020-10789

2020-03-2514:15:12

Google

osv.dev

7.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.9%

JSON

openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php.

CPENameOperatorVersion
openitcockpiteqopenITCOCKPIT-3.0.7
openitcockpiteqopenITCOCKPIT-3.0.11-8
openitcockpiteqopenITCOCKPIT-3.1.5
openitcockpiteqopenITCOCKPIT-3.0.6-1
openitcockpiteqopenITCOCKPIT-3.0.11
openitcockpiteqopenITCOCKPIT-3.5.0
openitcockpiteqopenITCOCKPIT-3.0.10
openitcockpiteqopenITCOCKPIT-3.0.10-4
openitcockpiteqopenITCOCKPIT-3.0.4
openitcockpiteqopenITCOCKPIT-3.1.1

Name	Operator	Version
openitcockpit	eq	openITCOCKPIT-3.0.7
openitcockpit	eq	openITCOCKPIT-3.0.11-8
openitcockpit	eq	openITCOCKPIT-3.1.5
openitcockpit	eq	openITCOCKPIT-3.0.6-1
openitcockpit	eq	openITCOCKPIT-3.0.11
openitcockpit	eq	openITCOCKPIT-3.5.0
openitcockpit	eq	openITCOCKPIT-3.0.10
openitcockpit	eq	openITCOCKPIT-3.0.10-4
openitcockpit	eq	openITCOCKPIT-3.0.4
openitcockpit	eq	openITCOCKPIT-3.1.1