Detections
Analytics

SolarWinds Platform 2024.4.0 < 2025.1 Multiple Vulnerabilities XSS

critical Nessus Plugin ID 216060

Language:

Synopsis

SolarWinds Platform is affected by a vulnerability

Description

The version of SolarWinds Platform installed on the remote host is prior to 2025.1. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwinds_platform_2025_1 advisory.

 - The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message.
 While the data does not provide anything sensitive, the information could assist an attacker in other malicious actions. (CVE-2024-52611)

 - SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied allowing for the possibility of a malicious web request. (CVE-2024-52606)

 - SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. This vulnerability requires authentication by a high- privileged account to be exploitable. (CVE-2024-52612)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to SolarWinds Platform version 2025.1 or later.

See Also

http://www.nessus.org/u?1e6c794a

http://www.nessus.org/u?87b31046

http://www.nessus.org/u?c037fdfa

Plugin Details

Severity: Critical

ID: 216060

File Name: solarwinds_solarwinds_platform_2025_1.nasl

Version: 1.4

Type: combined

Agent: windows

Family: CGI abuses

Published: 2/11/2025

Updated: 2/26/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-52606

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:solarwinds:orion_platform

Required KB Items: installed_sw/SolarWinds Orion Core

Exploit Ease: No known exploits are available

Patch Publication Date: 2/11/2025

Vulnerability Publication Date: 2/11/2025

Reference Information

CVE: CVE-2024-52606, CVE-2024-52611, CVE-2024-52612

IAVA: 2025-A-0113