CVE-2012-2577 Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sysloc...
MediumCVSS 4.3
EPSS 10.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| solarwinds orion network performance monitor | <= 10.2 | No fix listed |
| solarwinds orion network performance monitor | = 7.8.5 | No fix listed |
| solarwinds orion network performance monitor | = 8.5 | No fix listed |
| solarwinds orion network performance monitor | = 8.5.1 | No fix listed |
| solarwinds orion network performance monitor | = 9.0 | No fix listed |
| solarwinds orion network performance monitor | = 9.1 | No fix listed |
| solarwinds orion network performance monitor | = 9.5.1 | No fix listed |
| solarwinds orion network performance monitor | = 10.0 | No fix listed |
| solarwinds orion network performance monitor | = 10.1 | No fix listed |
References
- 50004 third-party-advisory vendor-advisory
- VU#174119 third-party-advisory us-government-resource
- 54624 exploit vdb-entry
- www.solarwinds.com vendor-advisory
- orionnetwork-snmpdconf-csrf(77147) vdb-entry