Design/Logic Flaw

2021-09-0112:15:00

PRIOn knowledge base

www.prio-n.com

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.6%

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.

CPENameOperatorVersion
orion_platformle2020.2.5
orion_platformeq2020.2.6

CPE	Name	Operator	Version
	orion_platform	le	2020.2.5
	orion_platform	eq	2020.2.6

References

documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm

support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US

www.solarwinds.com/trust-center/security-advisories/cve-2021-35238