Main Vulnerability Database SB2020021723

SB2020021723 - Stored cross-site scripting in SolarWinds Orion Network Performance Monitor

Published: February 17, 2020 Updated: January 3, 2021

Security Bulletin ID SB2020021723

Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Stored cross-site scripting (CVE-ID: CVE-2019-12954)

The disclosed vulnerability allows a authenticated users to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via a crafted onerror attribute of a VIDEO element in an action for an ALERT. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

https://www.esecforte.com/cve-2019-12954-solarwinds-network-performance-monitor-orion-platform-2018-npm-12-3-netpath-1-1-3-vulnerable-for-stored-xss/