CVE-2018-19386

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.

CVSS v3.0

6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

9.04% chance of exploitation in the next 30 days, 95th percentile

Nuclei

medium · CWE-79

Published

2019-08-14

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-an…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19386.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2018-19376
• CVE-2018-19404
• CVE-2018-19374
• CVE-2018-19410
• CVE-2018-19371
• CVE-2018-19414