SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.
References
Link | Resource |
---|---|
https://limenetworks.nl/wp-content/uploads/CVE-934261-v-1.2.pdf | Third Party Advisory |
https://www.solarwindsmsp.com/products/n-central | Product |
Configurations
History
No history.
Information
Published : 2020-10-19 13:15
Updated : 2024-02-28 18:08
NVD link : CVE-2020-15910
Mitre link : CVE-2020-15910
CVE.ORG link : CVE-2020-15910
JSON object : View
Products Affected
solarwinds
- n-central
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource