Skip to content
OpenAdvisories
Medium WID-SEC-2024-1212 4 CVEs

SolarWinds Platform: Mehrere Schwachstellen

Published May 21, 2024 · Updated May 21, 2024 · de-DE

Vendor: SolarWinds Product: Platform Platform: Linux Platform: Windows

Summary

Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in der SolarWinds-Plattform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site Scripting (XSS)-Angriffe durchzuführen oder Daten zu manipulieren.

Product

SolarWinds Platform (ehemals "Orion") ist eine IT Performance-Monitoring Plattform.

Vulnerabilities 4

  • High 7.9
    CVE-2024-29000

    SolarWinds Platform Reflected XSS Vulnerability

    The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability.

    SolarWinds SolarWinds Platform
  • High 7.5
    CVE-2024-29001

    SolarWinds Platform SWQL Injection Vulnerability

    A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user interaction to be exploited.

    SolarWinds SolarWinds Platform
  • High 7.5
    CVE-2024-29003

    SolarWinds Platform Cross Site Scripting Vulnerability

    The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requires authentication and requires user interaction.

    SolarWinds SolarWinds Platform
  • High 7.0
    CVE-2024-28076

    SolarWinds Platform Arbitrary Open Redirection Vulnerability

    The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL parameter with relative entry in the correct format

    SolarWinds SolarWinds Platform

Revision history

  1. #1

    Initiale Fassung

References