PT-2017-19003 · Solarwinds · Solarwinds Network Performance Monitor

Published 2017-10-02 · Updated 2018-10-09 · CVE-2017-9537

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SolarWinds Network Performance Monitor version 12.0.15300.90

Description The issue concerns a persistent cross-site scripting (XSS) flaw in the Add Node function. This allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters.

Recommendations For SolarWinds Network Performance Monitor version 12.0.15300.90, consider disabling the Add Node function until a patch is available to prevent exploitation of the XSS flaw.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9537

Affected Products

Solarwinds Network Performance Monitor

References · 4

• https://osv.dev/vulnerability/CVE-2017-9537 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9537 · Security Note
• http://securityfocus.com/archive/1/541262/100/0/threaded · Note
• http://securityfocus.com/bid/101071 · Note