CVE-2017-5473

EPSS 3.5%

Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/41141/unverified exploitdbwww.exploit-db.com/exploits/41141unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/ntop/ntopng/commit/1b2ceac8f578a246af6351c4f476e3102cdf21b3 https://github.com/ntop/ntopng/commit/f91fbe3d94c8346884271838ae3406ae633f6f15 https://www.exploit-db.com/exploits/41141/http://www.securityfocus.com/bid/95654