CVE-2020-10791

Name of the Vulnerable Software and Affected Versions openITCOCKPIT versions prior to 3.7.3

Description The issue allows remote authenticated users to trigger outbound TCP requests, also known as Server-Side Request Forgery (SSRF), via the Test Connection feature of the Grafana Module. This is achieved through the GrafanaConfigurationController.php file in the app/Plugin/GrafanaModule/Controller directory.

Recommendations For versions prior to 3.7.3, update to version 3.7.3 or later to resolve the issue. As a temporary workaround, consider disabling the Test Connection feature of the Grafana Module until a patch is available. Restrict access to the GrafanaConfigurationController.php file to minimize the risk of exploitation. Avoid using the Test Connection feature in the affected Grafana Module until the issue is resolved.