Technical impact
SolarWinds Observability Self‑Hosted contains a stored cross‑site scripting flaw that allows attackers to embed malicious scripts in data displayed to users. When such payloads are injected, they execute in the browsers of any user who views the affected content, enabling session hijacking, data theft, or delivery of additional malware.
Affected Systems
The vulnerability applies to all variants of SolarWinds Observability Self‑Hosted until an update is applied.
Risk and Exploitability
The flaw is considered of moderate severity. Exploration analyses suggest a low probability of active exploitation. The vulnerability is not catalogued as a known exploited vulnerability. Attackers must have the privilege to inject data into the system; the injected script runs when affected data is rendered in a victim’s browser.
