CVE-2012-2602: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2602?
CVE-2012-2602 is considered a medium severity vulnerability due to its impact on authentication and session management.
How do I fix CVE-2012-2602?
To fix CVE-2012-2602, upgrade SolarWinds Orion Network Performance Monitor to version 10.3.1 or later.
What types of attacks are possible with CVE-2012-2602?
CVE-2012-2602 allows remote attackers to execute cross-site request forgery attacks, potentially hijacking authentication for administrative requests.
Which versions of SolarWinds Orion are affected by CVE-2012-2602?
CVE-2012-2602 affects SolarWinds Orion Network Performance Monitor versions up to 10.2.2 and the specific version 10.1.13.0.
Who is primarily at risk from CVE-2012-2602?
Administrators using affected versions of SolarWinds Orion Network Performance Monitor are primarily at risk from CVE-2012-2602.