PT-2020-5351 · Solarwinds · Solarwinds Database Performance Analyzer

James Otten · Published 2020-12-15 · Updated 2020-12-17 · CVE-2018-16243

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SolarWinds Database Performance Analyzer (DPA) versions 11.1.468 through 12.0.3074

Description The issue is related to the failure to protect the web page structure, allowing a remote attacker to perform a cross-site scripting attack. This can be exploited through various components, including logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen.

Recommendations For versions 11.1.468 through 12.0.3074, consider disabling access to the affected components, such as logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen, until a patch is available. Restrict the use of these components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-00199

CVE-2018-16243

Affected Products

Solarwinds Database Performance Analyzer

References · 6

• https://osv.dev/vulnerability/CVE-2018-16243 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00199 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16243 · Security Note
• https://gist.github.com/james-otten/d3ee2f0fccc3b87aafe1616a6c2c2d4e · Note
• https://t.me/cibsecurity/20894 · Telegram Post
• https://cxsecurity.com/cveshow/CVE-2018-16243 · Note