CVE-2020-10792

Name of the Vulnerable Software and Affected Versions openITCOCKPIT versions 3.7.2 and earlier

Description The issue allows remote attackers to configure certain options by manipulating the HTTP Host header with specific keywords. This can be achieved by placing a hostname containing dev or staging in the header.

Recommendations For openITCOCKPIT versions 3.7.2 and earlier, as a temporary workaround, consider restricting access to configure the self::DEVELOPMENT or self::STAGING options until a patch is available. Avoid using hostnames containing dev or staging in the HTTP Host header to minimize the risk of exploitation.