PT-2020-9352
CVE-2019-12954
·
تاريخ النشر
2020-02-17
·
تاريخ التحديث
2020-02-28
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
SolarWinds Network Performance Monitor versions 2018, NPM 12.3, NetPath 1.1.3
Description:
The issue allows cross-site scripting (XSS) by authenticated users. This is achieved via a crafted
onerror attribute of a VIDEO element in an action for an ALERT.Recommendations:
For SolarWinds Network Performance Monitor versions 2018, NPM 12.3, NetPath 1.1.3, consider restricting access to the
ALERT action to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the onerror attribute in VIDEO elements within ALERT actions. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾