CVE-2015-8368

ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.

Published Bycve@mitre.org

Published DateDec 17, 2015, 19:59

Weakness Type (CWE):CWE-254

CVSS Metrics

Base Score

Vector String

AV:N/AC:M/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://packetstormsecurity.com/files/134593/ntop-ng-2.0.15102-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2015/Dec/10
https://www.exploit-db.com/exploits/38836/

Weakness Type (CWE):CWE-254

CVSS Metrics

Base Score

Vector String

AV:N/AC:M/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL