CVE-2012-4939

Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.kb.cert.org/vuls/id/203844	Exploit US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:solarwinds:ip_address_manager_web_interface::::::::
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:-:::::::*
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.0:::::::*
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.1:::::::*
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.1.13.0:::::::*
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.2:::::::*
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.2.1:::::::*
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.2.2:::::::*
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.3:::::::*
	cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.3.1:::::::*

History

No history.

Information

Published : 2012-10-31 19:55

Updated : 2024-02-04 18:16

NVD link : CVE-2012-4939

Mitre link : CVE-2012-4939

CVE.ORG link : CVE-2012-4939

JSON object : View

Products Affected

solarwinds

orion_network_performance_monitor
ip_address_manager_web_interface

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2012-4939", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-10-31T19:55:00.950", "references": [{"url": "http://www.kb.cert.org/vuls/id/203844", "tags": ["Exploit", "US Government Resource"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the \"Search for an IP address\" field."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la IPAMSummaryView.aspx en el interfaz web IPAM anterior a v3.0-HotFix1 en SolarWinds Orion Network Performance Monitor puede permitir a un atacante remoto inyectar c\u00f3digo script o HTML de su elecci\u00f3n a trav\u00e9s del campo \"Search for an IP address\""}], "lastModified": "2012-11-02T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:solarwinds:ip_address_manager_web_interface:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "651B667A-F5D1-4B6C-91C5-7EE69D28AB0A", "versionEndIncluding": "3.0"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0433752B-FCEB-4313-A137-3F2E970D8BF0"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8C131A4-FE0E-4BE7-A2B4-70518469316D"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAA52FCF-76A8-4738-B14E-27156757677D"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.1.13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C087ECB-98D9-4ED7-A431-4254BAF4E5A3"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27A83D40-5923-4D79-B03B-4BD0F72D9997"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D90725C-2B9F-4214-A7CD-7B6D31578835"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CBA6127-2A33-40E7-A28A-502DE8CB96A9"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48202B60-AAB5-457C-A24E-BE8C5B18E3A6"}, {"criteria": "cpe:2.3:a:solarwinds:orion_network_performance_monitor:10.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0F22FA7-C52B-4DF7-BF53-1C5671840625"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}