CVEvulnerability

CVE-2020-15910

4.7 MEDIUM Published 2020-10-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-10-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-732

Description

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.

Affected configurations

• solarwinds n-central (<= 12.3)

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References