Lucene search

SolarWindsCVELIST:CVE-2022-47509

HistoryApr 21, 2023 - 12:00 a.m.

CVE-2022-47509 SolarWinds Platform Incorrect Input Neutralization Vulnerability

2023-04-2100:00:00

CWE-79

SolarWinds

www.cve.org

solarwinds

platform

vulnerability

remote

html

injection

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.5%

JSON

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SolarWinds Platform",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThanOrEqual": "2023.2",
        "status": "affected",
        "version": "2023.1 and prior versions",
        "versionType": "custom"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/CVE-2022-47509

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.5%

JSON

Related for CVELIST:CVE-2022-47509