Unscored severity · published Aug 12, 2012
CVE-2012-2577
Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or…
–
CVSS
10.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.
Exploitation
Is it being used?
Exploit prediction (EPSS)10.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
Orion Network Performance Monitor · Solarwinds
through 10.2; 7.8.5; 8.5; 8.5.1; 9.0; 9.1; +3 more · source: NVD
Affected product
ON
Orion Network Performance Monitor
Solarwinds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2577
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2577
Vendor Advisory
http://secunia.com/advisories/50004
US Government Resource
http://www.kb.cert.org/vuls/id/174119
Exploit
http://www.securityfocus.com/bid/54624
Vendor Advisory
http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/77147
More from Orion Network Performance Monitor
9.8
CVE-2019-8917
SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service
8.8
CVE-2020-14005
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event
5.4
CVE-2020-14007
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition
5.4
CVE-2020-14006
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team
–
CVE-2014-9566
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance…