Lucene search

SolarWindsCVELIST:CVE-2024-29004

HistoryJun 04, 2024 - 2:53 p.m.

CVE-2024-29004 SolarWinds Platform Stored XSS Vulnerability

2024-06-0414:53:26

CWE-79

SolarWinds

www.cve.org

cve-2024-29004

solarwinds

stored xss

vulnerability

high-privileged user

web console

7.1 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "SolarWinds Platform ",
    "vendor": "SolarWinds ",
    "versions": [
      {
        "status": "affected",
        "version": "2024.1.1 and previous versions"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/CVE-2024-29004

7.1 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Related for CVELIST:CVE-2024-29004