CVE-2015-8368 ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.
MediumCVSS 6.0
EPSS 5.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parameter to admin/password_reset.lua.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntopng(Debian:13) | < 2.2+dfsg1-1 | 2.2+dfsg1-1 |
| debian/ntopng(Debian:13) | = 1.1+dfsg2-1 | No fix listed |
| debian/ntopng(Debian:13) | = 1.1+dfsg2-2 | No fix listed |
| debian/ntopng(Debian:13) | = 1.2.0+dfsg1-1 | No fix listed |
| debian/ntopng(Debian:13) | = 1.2.1+dfsg1-1 | No fix listed |
| debian/ntopng(Debian:13) | = 1.2.1+dfsg1-1.1 | No fix listed |
| debian/ntopng(Debian:13) | = 1.2.1+dfsg1-2 | No fix listed |
| debian/ntopng(Debian:13) | = 2.0+dfsg1-1 | No fix listed |
| ntopng | <= 2.0.151021 | No fix listed |
References
- packetstormsecurity.com exploit
- 20151209 ntop-ng <= 2.0.151021 - Privilege Escalation exploit mailing-list
- 38836 exploit
- security-tracker.debian.org vendor-advisory