PT-2016-5897 · Solarwinds · Solarwinds Storage Resource Monitor (Srm) Profiler
Rgod
·
Published
2016-04-28
·
Updated
2016-05-16
·
CVE-2016-4350
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
SolarWinds Storage Resource Monitor (SRM) Profiler versions prior to 6.2.3
Description
The issue concerns multiple SQL injection vulnerabilities in the Web Services web server. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via various parameters in different servlets, including
ScriptSchedule in the ScriptServlet servlet, winEventId or winEventLog in the WindowsEventLogsServlet servlet, processOS in the ProcessesServlet servlet, and others. This can lead to unauthorized access and manipulation of data.Recommendations
For versions prior to 6.2.3, update to version 6.2.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable servlets until a patch is applied.
Avoid using the specified parameters in the affected API endpoints until the issue is resolved.
Restrict access to the vulnerable modules to minimize the risk of exploitation.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Solarwinds Storage Resource Monitor (Srm) Profiler