PT-2020-9876 · Solarwinds · Solarwinds Orion Platform

Published 2020-01-17 · Updated 2020-01-22 · CVE-2019-17125

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SolarWinds Orion Platform version 2019.2 HF1

Description A Reflected Client Side Template Injection (CSTI) issue was found, allowing an attacker to inject an Angular expression and escape the Angular sandbox, resulting in stored XSS.

Recommendations For SolarWinds Orion Platform version 2019.2 HF1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-17125

Affected Products

Solarwinds Orion Platform

References · 4

• https://support.solarwinds.com/SuccessCenter/s/orion-platform · Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2019-4-Hotfix-3?ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1&r=116&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17125 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17125 · Vendor Advisory