SolarWinds Network Performance Monitor vulnerabilities

8 CVEs affecting SolarWinds Network Performance Monitor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-35225, published 2021-10-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-31474, published 2021-05-21. Critical severity, CVSS 9.8. EPSS: 93.9% chance of exploitation in the next 30 days. This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authentication is not required to exploit this…
CVE-2020-27869, published 2021-02-12. High severity, CVSS 8.8. EPSS: 5.3% chance of exploitation in the next 30 days. This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2. Authentication is required to exploit this…
CVE-2017-9537, published 2017-10-03. Medium severity, CVSS 4.8. EPSS: 2.8% chance of exploitation in the next 30 days. Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various…
CVE-2017-9538, published 2017-10-03. Medium severity, CVSS 4.9. EPSS: 2.4% chance of exploitation in the next 30 days. The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a "Cannot exit…
CVE-2018-13442, published 2019-07-16. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter.
CVE-2019-12863, published 2020-02-25. Medium severity, CVSS 4.8. EPSS: 1.1% chance of exploitation in the next 30 days. SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.
CVE-2021-35225, published 2021-10-21. Medium severity, CVSS 6.4. EPSS: 0.8% chance of exploitation in the next 30 days. Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a…
CVE-2019-12864, published 2020-05-04. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full…