Responsible Vulnerability Disclosure CVE-2019-12954 Solarwinds Network Performance Monitor Orion platform-2018 npm 12-3 netpath 1-1-3 vulnerable for stored xss
NPM is a powerful network monitoring software that enables you to quickly detect, diagnose, and resolve network performance problems and outages. NPM uses to identify network elements. During Discovery, NPM scans the network for nodes, and when a node and associated elements are found, you can add them to the SolarWinds database for monitoring.
eSecForte Technologies Security Researcher – Vaibhav Rai found a stored XSS vulnerability in the latest version for SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) and it has been assigned CVE-2019-12954 by the MITRE. SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users.
1. Open the solar wind console login with credential then click on http___www.bigleaguekickball.com_about_ Buying Soma overnight delivery ALERT&ACTIVITY and open
2. Now click on action manager.
3. Select action name then click on edit action and put the script tag “<video src=1 onerror=alert(esecforte)>” in Name of action Click on save changes
4. Now select the action alert and Click on TEST.
5. The script was executed successfully.
- Reported the Vulnerability to the Vendor Security or PSIRT Team
- Acknowledged confirmed from the Vendor that vulnerability exist
- CVE has been filed in NVD
- Vendor confirm that the vulnerability is fixed or a latest version, patch is released
- Vulnerability disclosed to the public
[Has vendor confirmed or acknowledged the vulnerability?]
Vaibhav Rai from eSecForte Technologies Pvt Ltd https://www.esecforte.com/