CVE-2024-45715 - OpenCVE

The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Solarwinds	Solarwinds Platform

Configuration 1 [-]

cpe:2.3:a:solarwinds:solarwinds_platform:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45715

History

Wed, 30 Oct 2024 21:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Solarwinds Solarwinds solarwinds Platform
CPEs		cpe:2.3:a:solarwinds:solarwinds_platform::::::::
Vendors & Products		Solarwinds Solarwinds solarwinds Platform

Wed, 16 Oct 2024 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 16 Oct 2024 07:30:00 +0000

Type	Values Removed	Values Added
Description		The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements.
Title		SolarWinds Platform Edit Function Cross-Site Scripting Vulnerability
Weaknesses		CWE-79
References		https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45715
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: SolarWinds

Published: 2024-10-16T07:17:59.891Z

Updated: 2024-10-16T13:27:15.463Z

Reserved: 2024-09-05T08:28:03.888Z

Link: CVE-2024-45715

Vulnrichment

Updated: 2024-10-16T13:27:11.076Z

NVD

Status : Analyzed

Published: 2024-10-16T08:15:07.110

Modified: 2024-10-30T20:59:19.737

Link: CVE-2024-45715

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45715", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "state": "PUBLISHED", "assignerShortName": "SolarWinds", "dateReserved": "2024-09-05T08:28:03.888Z", "datePublished": "2024-10-16T07:17:59.891Z", "dateUpdated": "2024-10-16T13:27:15.463Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "SolarWinds Platform", "vendor": "SolarWinds", "versions": [{"status": "affected", "version": "SolarWinds Platform 2024.2.1 and previous versions"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Maksym Vatsyk from Visa Cybersecurity Team"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements."}], "value": "The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2024-10-16T07:17:59.891Z"}, "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45715"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SolarWinds recommends that customers upgrade to SolarWinds Platform 2024.4 as soon as it becomes available.<br>\n\n<br>"}], "value": "SolarWinds recommends that customers upgrade to SolarWinds Platform 2024.4 as soon as it becomes available."}], "source": {"discovery": "UNKNOWN"}, "title": "SolarWinds Platform Edit Function Cross-Site Scripting Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-16T13:27:01.938888Z", "id": "CVE-2024-45715", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T13:27:15.463Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45715", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-16T13:27:01.938888Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T13:27:11.076Z"}}], "cna": {"title": "SolarWinds Platform Edit Function Cross-Site Scripting Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Maksym Vatsyk from Visa Cybersecurity Team"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SolarWinds", "product": "SolarWinds Platform", "versions": [{"status": "affected", "version": "SolarWinds Platform 2024.2.1 and previous versions"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "SolarWinds recommends that customers upgrade to SolarWinds Platform 2024.4 as soon as it becomes available.", "supportingMedia": [{"type": "text/html", "value": "SolarWinds recommends that customers upgrade to SolarWinds Platform 2024.4 as soon as it becomes available.<br>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45715"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements.", "supportingMedia": [{"type": "text/html", "value": "The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2024-10-16T07:17:59.891Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45715", "state": "PUBLISHED", "dateUpdated": "2024-10-16T13:27:15.463Z", "dateReserved": "2024-09-05T08:28:03.888Z", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "datePublished": "2024-10-16T07:17:59.891Z", "assignerShortName": "SolarWinds"}, "dataVersion": "5.1"}