Medium severity · published Oct 19, 2020
CVE-2020-15910
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly
4.7
CVSS
5.6%
EPSS
No
On KEV
Description
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)5.6% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
N-central · Solarwinds
through 12.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15910
Third Party Advisory
https://limenetworks.nl/wp-content/uploads/CVE-934261-v-1.2.pdf
Product
https://www.solarwindsmsp.com/products/n-central
More from N-central
8.8
CVE-2020-25622
An issue was discovered in SolarWinds N-Central 12.3.0.670
8.8
CVE-2020-25618
An issue was discovered in SolarWinds N-Central 12.3.0.670
8.8
CVE-2020-25617
An issue was discovered in SolarWinds N-Central 12.3.0.670
8.8
CVE-2020-15909
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access
8.4
CVE-2020-25621
An issue was discovered in SolarWinds N-Central 12.3.0.670