SolarWinds Orion Platform 2018.4 HF3 Error query?lang=en-us&swAlertOnError=false Query information disclosure

Summaryinfo

A vulnerability was found in SolarWinds Orion Platform 2018.4 HF3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file api2/swis/query?lang=en-us&swAlertOnError=false of the component Error Handler. The manipulation of the argument Query as part of Parameter results in information disclosure. This vulnerability is cataloged as CVE-2019-12864. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in SolarWinds Orion Platform 2018.4 HF3. Affected is an unknown code of the file api2/swis/query?lang=en-us&swAlertOnError=false of the component Error Handler. The manipulation of the argument query as part of a Parameter leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter.

The weakness was shared 05/04/2020. This vulnerability is traded as CVE-2019-12864 since 06/16/2019. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• SolarWinds

Name

• Orion Platform

Version

• 2018.4 HF3

License

• commercial

Website

• Vendor: https://www.solarwinds.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion