Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx.
References
| Link | Resource |
|---|---|
| http://osvdb.org/84116 | |
| http://secunia.com/advisories/50004 | Vendor Advisory |
| http://www.exploit-db.com/exploits/20011 | Exploit |
| http://www.kb.cert.org/vuls/id/174119 | US Government Resource |
| http://www.securityfocus.com/bid/54624 | Exploit |
| http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm | |
| http://osvdb.org/84116 | |
| http://secunia.com/advisories/50004 | Vendor Advisory |
| http://www.exploit-db.com/exploits/20011 | Exploit |
| http://www.kb.cert.org/vuls/id/174119 | US Government Resource |
| http://www.securityfocus.com/bid/54624 | Exploit |
| http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://osvdb.org/84116 - | |
| References | () http://secunia.com/advisories/50004 - Vendor Advisory | |
| References | () http://www.exploit-db.com/exploits/20011 - Exploit | |
| References | () http://www.kb.cert.org/vuls/id/174119 - US Government Resource | |
| References | () http://www.securityfocus.com/bid/54624 - Exploit | |
| References | () http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm - |
Information
Published : 2012-08-12 16:55
Updated : 2024-11-21 01:39
NVD link : CVE-2012-2602
Mitre link : CVE-2012-2602
CVE.ORG link : CVE-2012-2602
JSON object : View
Products Affected
solarwinds
- orion_network_performance_monitor
CWE
CWE-352
Cross-Site Request Forgery (CSRF)