Orion Platform
by SolarWinds
CVEs (57)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-35221 | Med | 0.41 | 6.3 | 0.02 | Aug 31, 2021 | Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. | ||
| CVE-2022-47509 | Med | 0.40 | 6.1 | 0.01 | Apr 21, 2023 | The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML. | ||
| CVE-2022-36965 | Med | 0.40 | 6.1 | 0.01 | Sep 30, 2022 | Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0). | ||
| CVE-2019-17127 | Med | 0.40 | 6.1 | 0.02 | Jan 17, 2020 | A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege… | ||
| CVE-2019-17125 | Med | 0.40 | 6.1 | 0.02 | Jan 17, 2020 | A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. | ||
| CVE-2021-35219 | Med | 0.39 | 6.0 | 0.01 | Aug 31, 2021 | ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page. | ||
| CVE-2019-12864 | Med | 0.36 | 5.5 | 0.00 | May 4, 2020 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the… | ||
| CVE-2022-36966 | Med | 0.35 | 5.4 | 0.00 | Oct 20, 2022 | Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous. | ||
| CVE-2021-28674 | Med | 0.35 | 5.4 | 0.01 | Jul 30, 2021 | The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the… | ||
| CVE-2019-12954 | Med | 0.35 | 5.4 | 0.01 | Feb 17, 2020 | SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT. | ||
| CVE-2021-35225 | Med | 0.33 | 5.0 | 0.01 | Oct 21, 2021 | Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data… | ||
| CVE-2026-28301 | Med | 0.31 | 4.8 | 0.00 | Jun 9, 2026 | A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website. | ||
| CVE-2021-35238 | Med | 0.31 | 4.8 | 0.01 | Sep 1, 2021 | User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. | ||
| CVE-2021-3109 | Med | 0.31 | 4.8 | 0.01 | Mar 26, 2021 | The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account. | ||
| CVE-2020-35856 | Med | 0.31 | 4.8 | 0.01 | Mar 26, 2021 | SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page. | ||
| CVE-2019-12863 | Med | 0.31 | 4.8 | 0.01 | Feb 25, 2020 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen. | ||
| CVE-2014-9566 | 0.00 | — | 0.48 | Mar 10, 2015 | Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager… |
- risk 0.41cvss 6.3epss 0.02
Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.
- risk 0.40cvss 6.1epss 0.01
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.
- risk 0.40cvss 6.1epss 0.01
Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).
- risk 0.40cvss 6.1epss 0.02
A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege…
- risk 0.40cvss 6.1epss 0.02
A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS.
- risk 0.39cvss 6.0epss 0.01
ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.
- risk 0.36cvss 5.5epss 0.00
SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the…
- risk 0.35cvss 5.4epss 0.00
Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
- risk 0.35cvss 5.4epss 0.01
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the…
- risk 0.35cvss 5.4epss 0.01
SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT.
- risk 0.33cvss 5.0epss 0.01
Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data…
- risk 0.31cvss 4.8epss 0.00
A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.
- risk 0.31cvss 4.8epss 0.01
User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.
- risk 0.31cvss 4.8epss 0.01
The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account.
- risk 0.31cvss 4.8epss 0.01
SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.
- risk 0.31cvss 4.8epss 0.01
SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.
- CVE-2014-9566Mar 10, 2015risk 0.00cvss —epss 0.48
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager…
Page 3 of 3