Privilege Escalation in SolarWinds Network Performance Monitor by Remote Attackers

CVE-2020-27869

Summary

This vulnerability in SolarWinds Network Performance Monitor allows authenticated remote attackers to escalate user privileges. It stems from inadequate validation of user-supplied input within the WriteToFile method, which is exploited to improperly construct SQL queries. By leveraging this flaw, an attacker may reset the password for the Admin account, gaining unauthorized control over the system. For more details, refer to the advisory at Zero Day Initiative.

References