What’s Vulnerable › Vulnerabilities

CVE-2020-10790

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-25 · updated 2026-06-17
• Weakness: CWE-79

Description

openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.

Affected products

• openITCOCKPIT: before 3.7.3 — fixed in 3.7.3

How to fix

Upgrade to a fixed version: openITCOCKPIT 3.7.3. Check the vendor advisory for mitigations.

References

• https://github.com/it-novum/openITCOCKPIT/commit/3838d98d35ececc7e83cf0f7cf785c9a7729cdbf
• https://github.com/it-novum/openITCOCKPIT/commit/6c9bb1d7cf5f24683e704cee8c84b8b6d850d8bf
• https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
• https://github.com/it-novum/openITCOCKPIT/commit/3838d98d35ececc7e83cf0f7cf785c9a7729cdbf
• https://github.com/it-novum/openITCOCKPIT/commit/6c9bb1d7cf5f24683e704cee8c84b8b6d850d8bf
• https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/

Get alerted when CVE-2020-10790 or the next vulnerability affects your stack