CVE-2017-7459
HighSummary
Ntopng versions before 3.0 allow HTTP Response Splitting.
Risk Assessment
Exploitation of this vulnerability may lead to XSS attacks and manipulation of HTTP responses, jeopardizing data integrity and user security.
Recommendation
It is recommended to upgrade ntopng to version 3.0 or later to mitigate this vulnerability.
Other vulnerabilities in ntopng
See all- CVE-2017-7458High
The NetworkInterface::getHost function in ntopng before version 3.0 allows remote attackers to cause an application crash via a NULL pointer dereference when a field that should contain a hostname or IP address is empty.
- CVE-2017-5473High
CSRF vulnerability in ntopng version 2.4 allows remote attackers to hijack the authentication of arbitrary users. Examples of exploitation include admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
- CVE-2026-38968Critical
A vulnerability in ntopng up to version 6.6 allows predictable session identifiers, leading to session hijacking. HTTP session IDs are generated using weak time-seeded pseudo-randomness, making them deterministic or collision-prone.
Original NVD description (English source)
ntopng before 3.0 allows HTTP Response Splitting.