PT-2020-9346 · Solarwinds · Solarwinds Orion Platform+2

Published 2020-05-04 · Updated 2021-07-21 · CVE-2019-12864

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform version 2018.4 HF3 (NPM 12.4, NetPath 1.1.4)

Description: The issue is related to improper error handling with stack traces, which can lead to information leakage. This can be demonstrated by discovering a full pathname upon a 500 Internal Server Error via the "api2/swis/query?lang=en-us&swAlertOnError=false" query parameter.

Recommendations: For SolarWinds Orion Platform version 2018.4 HF3 (NPM 12.4, NetPath 1.1.4), consider disabling the api2/swis/query endpoint until a patch is available to prevent information leakage. Restrict access to the lang and swAlertOnError parameters in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2019-12864

Affected Products

Npm

Netpath

Solarwinds Orion Platform

References · 6

• 🔥 https://esecforte.com/network-performance-monitor-india-esec-forte-technologies · Exploit
• https://solarwinds.com/network-performance-monitor · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12864 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12864 · Vendor Advisory
• https://t.me/cibsecurity/11800 · Telegram Post
• https://t.me/cvenotify/3511 · Telegram Post