CVE-2020-12608

Name of the Vulnerable Software and Affected Versions SolarWinds MSP PME (Patch Management Engine) Cache Service versions prior to 1.1.15

Description An issue was discovered in the SolarWinds MSP PME Cache Service, where there are insecure file permissions for the directory containing the CacheService.xml configuration file. This can lead to code execution by changing the SISServerURL parameter in the CacheService.xml file.

Recommendations For versions prior to 1.1.15, update to version 1.1.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the %PROGRAMDATA%SolarWinds MSPSolarWinds.MSP.CacheServiceconfig directory to prevent unauthorized changes to the CacheService.xml file.