CVE-2017-6803: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that (1) change the admin password, (2) terminate the scheduler, or (3) possibly execute arbitrary commands via crafted requests to Admin/XML/Result.xml.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6803?
CVE-2017-6803 is considered a medium severity vulnerability due to its ability to allow unauthorized actions through cross-site request forgery.
How do I fix CVE-2017-6803?
To fix CVE-2017-6803, it is recommended to apply the latest patches provided by SolarWinds for FTP Voyager.
What types of attacks does CVE-2017-6803 enable?
CVE-2017-6803 enables remote attackers to perform unauthorized actions such as changing the admin password and terminating the scheduler.
What versions of SolarWinds are affected by CVE-2017-6803?
CVE-2017-6803 specifically affects SolarWinds FTP Voyager version 16.2.0.
How can I mitigate the risks associated with CVE-2017-6803?
Mitigating the risks of CVE-2017-6803 involves implementing CSRF protections and improving user authentication mechanisms in the web interface.