Unscored severity · published Aug 12, 2012
CVE-2012-2602
Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication…
–
CVSS
6%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.0% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
Orion Network Performance Monitor · Solarwinds
through 10.2.2; 10.1.13.0 · source: NVD
Affected product
ON
Orion Network Performance Monitor
Solarwinds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2602
osvdb.org
http://osvdb.org/84116
Vendor Advisory
http://secunia.com/advisories/50004
Exploit
http://www.exploit-db.com/exploits/20011
US Government Resource
http://www.kb.cert.org/vuls/id/174119
Exploit
http://www.securityfocus.com/bid/54624
www.solarwinds.com
http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm
More from Orion Network Performance Monitor
9.8
CVE-2019-8917
SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service
8.8
CVE-2020-14005
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event
5.4
CVE-2020-14007
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition
5.4
CVE-2020-14006
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team
–
CVE-2014-9566
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance…