Persistent Cross-Site Scripting in SolarWinds Network Performance Monitor
CVE-2017-9537

4.8MEDIUM

Key Information:

Vendor

Solarwinds
Status
Network Performance Monitor
Vendor
CVE Published:
3 October 2017

What is CVE-2017-9537?

A persistent cross-site scripting vulnerability exists in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90. This vulnerability allows remote attackers to inject arbitrary JavaScript into various vulnerable parameters. If exploited, this could lead to the execution of malicious scripts in the context of the user's session, potentially compromising sensitive information and user credentials. Organizations using this version of the software are advised to implement proper security measures to mitigate potential risks.

References

http://www.securityfocus.com/archive/1/541262/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/101071
vdb-entryx_refsource_BID

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.