# CVE-2017-5473: ntop ntopng CSRF in administrative web interface

Source: https://junglewise.ai/threats/cve-2017-5473-ntop-ntopng-csrf-in-administrative-web-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-14. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5473 · Severity: high · CVSS 8.8 · Published 2017-01-14

A security vulnerability exists in ntopng, a network traffic monitoring tool, that allows attackers to perform unauthorized administrative actions. By tricking a logged-in administrator into clicking a malicious link or visiting a compromised website, an attacker can change passwords, add new administrative users, or modify system settings. This could lead to a complete takeover of the monitoring tool and unauthorized access to network traffic data.

Technologies: [Ntopng](https://junglewise.ai/threats/technologies/ntopng). Vendors: [Ntop](https://junglewise.ai/threats/vendors/ntop).

## Quick answers

**Is CVE-2017-5473 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5473 being exploited in the wild.

**How severe is CVE-2017-5473?** High severity, with a CVSS score of 8.8, published 14 January 2017.

**Which products and versions are affected?** ntop ntopng through 2.4.

**Is there a fix for CVE-2017-5473?** A patch was published on 2017-01-20: Vendor fixed issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5473 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2017-5473?** Check whether you run Ntopng. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web interface of ntopng through version 2.4. The application fails to properly validate CSRF tokens in several administrative Lua scripts, including add_user.lua, change_user_prefs.lua, delete_user.lua, and password_reset.lua. An attacker can bypass existing protections by either omitting the CSRF token entirely or providing an arbitrary value. If an authenticated administrator visits a malicious site or clicks a crafted link, the attacker can execute high-privilege actions such as resetting the admin password or creating new administrator accounts. The issue was addressed in commits 1b2ceac and f91fbe3 by implementing proper token presence and validity checks.

## Affected products

- ntop ntopng through 2.4

## Timeline

- 2017-01-11: disclosed: Vendor notified
- 2017-01-14: advisory: NVD published date
- 2017-01-20: patched: Vendor fixed issue

## References

- [http://www.securityfocus.com/bid/95654](http://www.securityfocus.com/bid/95654)
- [https://github.com/ntop/ntopng/commit/1b2ceac8f578a246af6351c4f476e3102cdf21b3](https://github.com/ntop/ntopng/commit/1b2ceac8f578a246af6351c4f476e3102cdf21b3)
- [https://github.com/ntop/ntopng/commit/f91fbe3d94c8346884271838ae3406ae633f6f15](https://github.com/ntop/ntopng/commit/f91fbe3d94c8346884271838ae3406ae633f6f15)
- [https://www.exploit-db.com/exploits/41141/](https://www.exploit-db.com/exploits/41141/)

## Related threats

- [ntopng stack buffer overflow in nDPI custom category detection](https://junglewise.ai/threats/cve-2026-97371-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng OS command injection in vulnerability-scan REST endpoint](https://junglewise.ai/threats/cve-2026-82413-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng authorization bypass in system configuration backup download](https://junglewise.ai/threats/cve-2026-84990-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng missing authorization check in blacklist editor](https://junglewise.ai/threats/cve-2026-83621-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng remote code execution via unauthenticated scan endpoints](https://junglewise.ai/threats/cve-2026-82412-ntopng-is-a-web-based-network-traffic-monitoring-application)