Unscored severity · published Dec 17, 2015
CVE-2015-8368
ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to…
–
CVSS
5.1%
EPSS
No
On KEV
Description
ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NT
Ntopng · Ntop
through 2.0.151021 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8368
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8368
packetstormsecurity.com
http://packetstormsecurity.com/files/134593/ntop-ng-2.0.15102-Privilege-Escalation.html
seclists.org
http://seclists.org/fulldisclosure/2015/Dec/10
www.exploit-db.com
https://www.exploit-db.com/exploits/38836/
security-tracker.debian.org
https://security-tracker.debian.org/tracker/CVE-2015-8368
More from Ntopng
9.8
CVE-2026-38968
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking
8.8
CVE-2026-84990
ntopng: Missing Authorization on System Configuration Backup Download and Listing
8.8
CVE-2026-82412
ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API
8.8
CVE-2017-5473
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by…
8.1
CVE-2026-83621
ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs