CVE-2012-2577

Опубликовано: 12 авг. 2012

Источник: nvd

CVSS2: 4.3

EPSS Средний

Описание

Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.

Ссылки

http://secunia.com/advisories/50004
Vendor Advisory
http://www.kb.cert.org/vuls/id/174119
US Government Resource
http://www.securityfocus.com/bid/54624
Exploit
http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/77147
http://secunia.com/advisories/50004
Vendor Advisory
http://www.kb.cert.org/vuls/id/174119
US Government Resource
http://www.securityfocus.com/bid/54624
Exploit
http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/77147

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:solarwinds:orion_network_performance_monitor:*:*:*:*:*:*:*:*

Версия до 10.2 (включая)

cpe:2.3:a:solarwinds:orion_network_performance_monitor:7.8.5:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_network_performance_monitor:8.5:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_network_performance_monitor:8.5.1:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_network_performance_monitor:9.0:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_network_performance_monitor:9.1:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_network_performance_monitor:9.5.1:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.0:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.1:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.21828

Средний

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-c2w8-wjm8-q9r4

github

больше 3 лет назад