SolarWinds Netpath vulnerabilities

2 CVEs affecting SolarWinds Netpath, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-12864, published 2020-05-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-12863, published 2020-02-25. Medium severity, CVSS 4.8. EPSS: 1.1% chance of exploitation in the next 30 days. SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.
CVE-2019-12864, published 2020-05-04. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full…