SQL Injection Vulnerability in SolarWinds Storage Manager and Related Products
CVE-2012-2576

9.8CRITICAL

Key Information:

Vendor
Solarwinds
Status
Backup Profiler
Storage Profiler
Storage Manager
Vendor
CVE Published:
20 December 2017

Summary

An SQL injection vulnerability exists in the LoginServlet page of several SolarWinds products, including Storage Manager, Storage Profiler, and Backup Profiler. This vulnerability allows remote attackers to manipulate SQL queries through the loginName field, potentially leading to unauthorized access and the execution of arbitrary SQL commands. Affected versions prior to 5.1.2 must be updated to mitigate this risk.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/72680
vdb-entryx_refsource_XF
http://www.solarwinds.com/documentation/storage/storagema...
x_refsource_CONFIRM
http://www.exploit-db.com/exploits/18818
exploitx_refsource_EXPLOIT-DB

EPSS Score

12% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.