Lucene search

[email protected]CVE-2021-35229

HistoryApr 21, 2022 - 7:15 p.m.

CVE-2021-35229

2022-04-2119:15:08

CWE-79

[email protected]

web.nvd.nist.gov

cve-2021-35229

cross-site scripting

database performance monitor

sql query

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

33.3%

JSON

Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query

Affected configurations

NVD

Node

solarwindsdatabase_performance_analyzerRange<2022.2

solarwindsdatabase_performance_monitorRange≤2022.1.7779

CPENameOperatorVersion
solarwinds:database_performance_analyzersolarwinds database performance analyzerlt2022.2
solarwinds:database_performance_monitorsolarwinds database performance monitorle2022.1.7779

CPE	Name	Operator	Version
solarwinds:database_performance_analyzer	solarwinds database performance analyzer	lt	2022.2
solarwinds:database_performance_monitor	solarwinds database performance monitor	le	2022.1.7779

CNA Affected

[
  {
    "product": "Database Performance Monitor",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThan": "2022.1",
        "status": "affected",
        "version": "2022.1.7779 and previous versions",
        "versionType": "custom"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2022-2_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/cve-2021-35229

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

33.3%

JSON

Related for CVE-2021-35229

prion1 cvelist1 nvd1