CVE-2024-5445: Improper Certificate Validation

Ecosystem Agent version 4 4.1.5.2597 and Ecosystem Agent version 5 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position...

CVE-2024-5445

CVE-2024-5445 affects Ecosystem Agent versions 4.0–4.1.5.2597 and 5.0–5.1.4.2473. The root cause is improper validation of SSL/TLS certificates, enabling a potential Man-in-the-Middle between the agent and N-able servers from a privileged network position. Reported across multiple sources (includ...

CVE-2024-5445 Ecosystem Agent Insufficient Transport Layer Security

Ecosystem Agent version 4 4.1.5.2597 and Ecosystem Agent version 5 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position...

CVE-2024-28200

The N-able N-central server is vulnerable to an authentication bypass in its user interface, affecting all deployments prior to version 2024.2 . This flaw allows attackers to access restricted areas without proper credentials, potentially leading to unauthorized data access or control. The vulner...

N-able N-Central Security Vulnerability

N-able N-Central is a powerful, customizable remote monitoring and management platform from N-able. A security vulnerability previously existed in N-able N-Central version 2024.2, which stemmed from a user interface authentication that could be bypassed...

CVE-2023-37244 Privilege escalation in N-Able's AutomationManagerAgent

The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into...

CVE-2023-37244

The CVE-2023-37244 entry concerns AutomationManager.AgentService.exe and describes a TOCTOU race condition that lets standard users create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp. This could enable an attacker to manipulate the process into performing arbitra...

The vulnerability of the N-able PassPortal data management tool, related to insufficient protection of registration data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the N-able PassPortal data management tool is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2023-47131

The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...

CVE-2023-47131

The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...

CVE-2023-47132

An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...

Design/Logic Flaw

The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...

Code injection

An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...

CVE-2023-47131: Insertion of Sensitive Information into Log File

The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...

CVE-2023-47132: Improper Privilege Management

An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...

CVE-2023-47131

The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...

CVE-2023-47131

The CVE-2023-47131 issue affects the N-able PassPortal Chrome extension and is caused by the extension inserting sensitive information into log files in versions prior to 3.29.2. The impact is sensitive data disclosed via logs (as stated across Red Hat, NVD, CVE lists). Remediation is to upgrade ...

CVE-2023-47132

An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...

CVE-2023-47131

The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...

N-able N-central Security Vulnerabilities

N-able N-central is an RMM platform from N-able, Inc. providing large-scale management, automation and orchestration capabilities for sophisticated MSPs and IT professionals. A security vulnerability exists in N-able N-central version 2023.6 and prior versions, which stems from a vulnerability th...