PT-2017-19004 · Solarwinds · Solarwinds Network Performance Monitor

Publicado 2017-10-02 · Atualizado 2018-10-09 · CVE-2017-9538

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SolarWinds Network Performance Monitor version 12.0.15300.90

Description The issue is related to the 'Upload logo from external path' function, which allows remote attackers to cause a denial of service. This denial of service results in a permanent display of a "Cannot exit above the top directory" error message throughout the entire web application. The cause of the denial of service is an incorrect implementation of a directory-traversal protection mechanism, specifically when a ".." is used in the path field.

Recommendations For SolarWinds Network Performance Monitor version 12.0.15300.90, consider disabling the 'Upload logo from external path' function as a temporary workaround until a patch is available. Restrict access to this function to minimize the risk of exploitation. Avoid using the ".." in the path field in the affected function until the issue is resolved.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-9538

Produtos afetados

Solarwinds Network Performance Monitor

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-9538 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9538 · Aviso do Fabricante
• http://securityfocus.com/bid/101066 · Nota
• http://securityfocus.com/archive/1/541263/100/0/threaded · Nota