What’s Vulnerable › Vulnerabilities

CVE-2020-10788

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-25 · updated 2026-06-17
• Weakness: CWE-798

Description

openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.

Affected products

• openITCOCKPIT: before 3.7.3 — fixed in 3.7.3

How to fix

Upgrade to a fixed version: openITCOCKPIT 3.7.3. Check the vendor advisory for mitigations.

References

• https://github.com/it-novum/openITCOCKPIT/commit/581cc9007bbfba84a2575729d5d903ab3a8f25ee
• https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
• https://github.com/it-novum/openITCOCKPIT/commit/581cc9007bbfba84a2575729d5d903ab3a8f25ee
• https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/

Get alerted when CVE-2020-10788 or the next vulnerability affects your stack