CVE-2020-15910

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://limenetworks.nl/wp-content/uploads/CVE-934261-v-1.2.pdfThird Party Advisory
https://www.solarwindsmsp.com/products/n-centralProduct
https://limenetworks.nl/wp-content/uploads/CVE-934261-v-1.2.pdfThird Party Advisory
https://www.solarwindsmsp.com/products/n-centralProduct

Timeline

Published: Oct 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-159126.5Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the ven CVE-2020-159145.4A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker CVE-2020-159169.8goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell CVE-2020-159179.8common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.CVE-2020-159185.4Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0.CVE-2020-159196.1A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.CVE-2020-15924.4<p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p> <p>To exploit this v CVE-2020-159209.8There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with admini CVE-2020-159219.8Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities,CVE-2020-159229.8There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative CVE-2020-159237.5Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.CVE-2020-159247.5There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection