CVE-2012-2602

Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx.

• CWE-352

• http://osvdb.org/84116
• http://secunia.com/advisories/50004Vendor Advisory
• http://www.exploit-db.com/exploits/20011Exploit
• http://www.kb.cert.org/vuls/id/174119US Government Resource
• http://www.securityfocus.com/bid/54624Exploit
• http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm
• http://osvdb.org/84116
• http://secunia.com/advisories/50004Vendor Advisory
• http://www.exploit-db.com/exploits/20011Exploit
• http://www.kb.cert.org/vuls/id/174119US Government Resource
• http://www.securityfocus.com/bid/54624Exploit
• http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm

Published

Aug 12, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-2595Multiple cross-site scripting (XSS) vulnerabilities in unspe…
• CVE-2012-2596The XPath functionality in unspecified web applications in S…
• CVE-2012-2597Multiple directory traversal vulnerabilities in Siemens WinC…
• CVE-2012-2598Buffer overflow in the DiagAgent web server in Siemens WinCC…
• CVE-2012-2599Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2012-2601SQL injection vulnerability in WrVMwareHostList.asp in Ipswi…
• CVE-2012-2603The server in CollabNet ScrumWorks Pro before 6.0 allows rem…
• CVE-2012-2604Multiple cross-site scripting (XSS) vulnerabilities in Guest…
• CVE-2012-2605Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2012-2606The agent in Bradford Network Sentry before 5.3.3 does not r…
• CVE-2012-2607The Johnson Controls CK721-A controller with firmware before…
• CVE-2012-2611The DiagTraceR3Info function in the Dialog processor in disp…