CVE-2020-15910: Medium severity solarwinds vulnerability

Q: What is the severity of CVE-2020-15910?

CVE-2020-15910 is classified as a medium severity vulnerability.

Q: How do I fix CVE-2020-15910?

To fix CVE-2020-15910, ensure that you upgrade to SolarWinds N-Central version 12.4 or later, which sets the JSESSIONID attribute to HTTPOnly.

Q: What type of vulnerability is CVE-2020-15910?

CVE-2020-15910 is a cookie-based vulnerability that allows JavaScript access to the JSESSIONID.

Q: Can I be attacked through CVE-2020-15910?

Yes, CVE-2020-15910 could allow attackers to steal session cookies via client-side scripts.

Q: What systems are affected by CVE-2020-15910?

CVE-2020-15910 affects SolarWinds N-Central versions 12.3 GA and lower.

Published Oct 19, 2020

Updated

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.

Affected Software

1 affected component

SolarWinds N-Central<=12.3

Event History

Oct 19, 2020

CVE Published

via MITRE·12:57 PM

Data Sourced

via MITRE·12:57 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-15910?

CVE-2020-15910 is classified as a medium severity vulnerability.

How do I fix CVE-2020-15910?

To fix CVE-2020-15910, ensure that you upgrade to SolarWinds N-Central version 12.4 or later, which sets the JSESSIONID attribute to HTTPOnly.

What type of vulnerability is CVE-2020-15910?