Solarwinds Orion Network Performance Monitor : List of security vulnerabilities

#

CVE ID

CWE ID

# of Exploits

Vulnerability Type(s)

Publish Date

Update Date

Score

Gained Access Level

Access

Complexity

Authentication

Conf.

Integ.

Avail.

1
CVE-2020-14007
79

XSS
2020-06-24
2020-07-07

3.5

None
Remote
Medium
???
None
Partial
None

Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition.

2
CVE-2020-14006
79

XSS
2020-06-24
2020-07-07

3.5

None
Remote
Medium
???
None
Partial
None

Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team.

3
CVE-2020-14005

Exec Code
2020-06-24
2022-10-29

9.0

None
Remote
Low
???
Complete
Complete
Complete

Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.

4
CVE-2019-8917

Exec Code
2019-02-18
2020-08-24

10.0

None
Remote
Low
Not required
Complete
Complete
Complete

SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may be abused by an attacker to execute commands as the SYSTEM user.

5
CVE-2014-9566
89

1

Exec Code Sql
2015-03-10
2015-03-11

7.5

None
Remote
Low
Not required
Partial
Partial
Partial

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other Solarwinds products, allow remote authenticated users to execute arbitrary SQL commands via the (1) dir or (2) sort parameter to the (a) GetAccounts or (b) GetAccountGroups endpoint.

6
CVE-2012-4939
79

XSS
2012-10-31
2012-11-02

4.3

None
Remote
Medium
Not required
None
Partial
None

Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the “Search for an IP address” field.

7
CVE-2012-2602
352

1

CSRF
2012-08-12
2012-08-13

6.8

None
Remote
Medium
Not required
Partial
Partial
Partial

Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx.

8
CVE-2012-2577
79

XSS
2012-08-12
2017-08-29

4.3

None
Remote
Medium
Not required
None
Partial
None

Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.

9
CVE-2010-4828
79

XSS
2011-08-24
2018-10-10

4.3

None
Remote
Medium
Not required
None
Partial
None

Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) 10.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Title parameter to MapView.aspx; NetObject parameter to (2) NodeDetails.aspx and (3) InterfaceDetails.aspx; and the (4) ChartName parameter to CustomChart.aspx.