CVE-2019-12954

Name of the Vulnerable Software and Affected Versions: SolarWinds Network Performance Monitor versions 2018, NPM 12.3, NetPath 1.1.3

Description: The issue allows cross-site scripting (XSS) by authenticated users. This is achieved via a crafted onerror attribute of a VIDEO element in an action for an ALERT.

Recommendations: For SolarWinds Network Performance Monitor versions 2018, NPM 12.3, NetPath 1.1.3, consider restricting access to the ALERT action to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the onerror attribute in VIDEO elements within ALERT actions.