CVE Feed

    Dashboard / CVE / CVE-2020-15910

    CVE-2020-15910

    SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.

    Published:Oct 19, 2020
    Last Modified:Nov 21, 2024
    EPS:Oct 19, 2020
    EPSS Score:0.00358
    CVSS Score:4.7

    Affected Products

    Vendor
    Solarwinds
    Product
    N-central

    Exploits

    No exploit reference

    Related CVEs

    CVE-2020-25622 (CVSS 8.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.…
    CVE-2020-25621 (CVSS 8.4) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication…
    CVE-2020-25620 (CVSS 7.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local …
    CVE-2020-25619 (CVSS 4.4) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communicat…
    CVE-2020-25618 (CVSS 8.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access contro…
    CVE-2020-25617 (CVSS 8.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative …
    CVE-2020-15909 (CVSS 8.8) — SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access.…
    CVE-2020-7984 (CVSS 7.5) — SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High