CVE Feed

    Dashboard / CVE / CVE-2020-25618

    CVE-2020-25618

    An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use of root privileges is not limited to specific programs listed in the sudoers file).

    Published:Dec 16, 2020
    Last Modified:Nov 21, 2024
    EPS:Dec 16, 2020
    EPSS Score:0.02628
    CVSS Score:8.8

    Affected Products

    Vendor
    Solarwinds
    Product
    N-central

    Exploits

    No exploit reference

    Related CVEs

    CVE-2020-25622 (CVSS 8.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.…
    CVE-2020-25621 (CVSS 8.4) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication…
    CVE-2020-25620 (CVSS 7.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local …
    CVE-2020-25619 (CVSS 4.4) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communicat…
    CVE-2020-25617 (CVSS 8.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative …
    CVE-2020-15910 (CVSS 4.7) — SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes i…
    CVE-2020-15909 (CVSS 8.8) — SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access.…
    CVE-2020-7984 (CVSS 7.5) — SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High