Medium severity · published Dec 15, 2020
CVE-2018-16243
SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen,…
5.4
CVSS
1.4%
EPSS
No
On KEV
Description
SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DP
Database Performance Analyzer · Solarwinds
11.1.468; 12.0.3074 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16243
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16243
Third Party Advisory
https://gist.github.com/james-otten/d3ee2f0fccc3b87aafe1616a6c2c2d4e
More from Database Performance Analyzer
7.5
CVE-2023-23837
No exception handling vulnerability which revealed sensitive or excessive information to users
7.5
CVE-2022-38112
In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext
6.5
CVE-2023-23838
Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server
6.4
CVE-2025-26398
SolarWinds Database Performance Analyzer Hard-coded Cryptographic Key Vulnerability
6.1
CVE-2023-33231
XSS attack was possible in DPA 2023.2 due to insufficient input validation