Lucene search

MitreCVE-2019-12863

HistoryFeb 25, 2020 - 5:15 p.m.

CVE-2019-12863

2020-02-2517:15:11

CWE-79

mitre

web.nvd.nist.gov

solarwinds

orion platform

html injection

admin security

npm

netpath

cve-2019-12863

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.

Affected configurations

Nvd

Node

solarwindsnetpathMatch1.1.4

solarwindsnetwork_performance_monitorMatch12.4

solarwindsorion_platformMatch2018.4hotfix3

VendorProductVersionCPE
solarwindsnetpath1.1.4cpe:2.3:a:solarwinds:netpath:1.1.4:*:*:*:*:*:*:*
solarwindsnetwork_performance_monitor12.4cpe:2.3:a:solarwinds:network_performance_monitor:12.4:*:*:*:*:*:*:*
solarwindsorion_platform2018.4cpe:2.3:a:solarwinds:orion_platform:2018.4:hotfix3:*:*:*:*:*:*

Vendor	Product	Version	CPE
solarwinds	netpath	1.1.4	cpe:2.3:a:solarwinds:netpath:1.1.4:::::::*
solarwinds	network_performance_monitor	12.4	cpe:2.3:a:solarwinds:network_performance_monitor:12.4:::::::*
solarwinds	orion_platform	2018.4	cpe:2.3:a:solarwinds:orion_platform:2018.4:hotfix3::::::

References

www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-12863-stored-html-injection-vulnerability-in-solarwinds-orion-platform-2018-4-hf3-npm-12-4-netpath-1-1-4/

www.solarwinds.com/network-performance-monitor

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2019-12863