SQL Injection Vulnerability in SolarWinds Storage Manager and Related Products
CVE-2012-2576
9.8CRITICAL
Key Information:
- Vendor
- Solarwinds
- Vendor
- CVE Published:
- 20 December 2017
Summary
An SQL injection vulnerability exists in the LoginServlet page of several SolarWinds products, including Storage Manager, Storage Profiler, and Backup Profiler. This vulnerability allows remote attackers to manipulate SQL queries through the loginName field, potentially leading to unauthorized access and the execution of arbitrary SQL commands. Affected versions prior to 5.1.2 must be updated to mitigate this risk.
References
EPSS Score
12% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved