CVE-2019-12864

low-risk
Published 2020-05-04

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter.

Do I need to act?

-
0.22% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (3)

Netpath

Affected Vendors

Solarwinds

References (4)

Exploit https://www.esecforte.com/network-performance-monitor-india-esec-forte-technolog...
Vendor Advisory https://www.solarwinds.com/network-performance-monitor
Exploit https://www.esecforte.com/network-performance-monitor-india-esec-forte-technolog...
Vendor Advisory https://www.solarwinds.com/network-performance-monitor
28
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 9/34 · Low