CVE-2017-5473

Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to...

8.8 HighPublic exploit

Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.52%Down 2.1 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2017-5473
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-5473
Updated: 2026-11-02

EUVDEUVD-2017-14577 No score

Record: EUVD-2017-14577
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5qh4-jjjw-xg4h 8.8

Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to...

Record: GHSA-5qh4-jjjw-xg4h
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

OSV 8.8

Record: CVE-2017-5473
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-5473 8.8

Record: UBUNTU-CVE-2017-5473
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

ntop ntopng

Affected packages

Affected packages
Package	Affected	Fixed
`ntopng` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.2.1+dfsg1-2ubuntu12.0+dfsg1-12.2+dfsg1-12.2+dfsg1-1build12.2+dfsg1-1ubuntu0.1~esm2	None known
`ntopng` Ubuntu:22.04:LTS	All versions, plus listed versions 5.2.1+dfsg1-1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	NTOPNG 2.4 Web Interface - Cross-Site Request Forgery	2017-01-22

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-5473 is a high vulnerability (CVSS 8.8) in Ntop Ntopng, published January 14, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.52%, the 89th percentile. No source names a fixed version.