SolarWinds Orion Web Performance Monitor vulnerabilities

4 CVEs affecting SolarWinds Orion Web Performance Monitor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-14007, published 2020-06-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9566, published 2015-03-10. High severity, CVSS 7.5. EPSS: 47.7% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before…
CVE-2020-14005, published 2020-06-24. High severity, CVSS 8.8. EPSS: 14.3% chance of exploitation in the next 30 days. Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.
CVE-2020-14007, published 2020-06-24. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition.
CVE-2020-14006, published 2020-06-24. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team.