CVE-2017-5473
HighSummary
CSRF vulnerability in ntopng version 2.4 allows remote attackers to hijack the authentication of arbitrary users. Examples of exploitation include admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
Risk Assessment
Attackers can gain access to user accounts and perform unauthorized actions, potentially leading to serious security breaches.
Recommendation
It is recommended to implement CSRF protections and update ntopng to the latest version to minimize risk.
Other vulnerabilities in ntopng
See all- CVE-2017-7458High
The NetworkInterface::getHost function in ntopng before version 3.0 allows remote attackers to cause an application crash via a NULL pointer dereference when a field that should contain a hostname or IP address is empty.
- CVE-2017-7459High
Ntopng versions before 3.0 allow HTTP Response Splitting.
- CVE-2026-38968Critical
A vulnerability in ntopng up to version 6.6 allows predictable session identifiers, leading to session hijacking. HTTP session IDs are generated using weak time-seeded pseudo-randomness, making them deterministic or collision-prone.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.