CVE-2020-15910 | BDVDB-2026-143249 Detail

Description#

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.solarwindsmsp.com/products/n-central
https://limenetworks.nl/wp-content/uploads/CVE-934261-v-1.2.pdf

Exploit#

No public exploit known

History#

Version 12020-10-19Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.