CVE-2018-13442

Name of the Vulnerable Software and Affected Versions SolarWinds Network Performance Monitor version 12.3

Description The issue allows SQL Injection via the "/api/ActiveAlertsOnThisEntity/GetActiveAlerts" TriggeringObjectEntityNames parameter.

Recommendations For SolarWinds Network Performance Monitor version 12.3, consider restricting access to the "/api/ActiveAlertsOnThisEntity/GetActiveAlerts" endpoint to minimize the risk of exploitation. Avoid using the TriggeringObjectEntityNames parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.