SolarWinds Server & Application Monitor Security Bypass and HTML Injection Vulnerabilities

Bugtraq ID:	65950
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Feb 02 2014 12:00AM
Updated:	Feb 02 2014 12:00AM
Credit:	Denis Andzakovic of Security Assessment
Vulnerable:	SolarWinds Server & Application Monitor 6.0.1
Not Vulnerable:	SolarWinds Server & Application Monitor 6.0.2

SolarWinds Server & Application Monitor Security Bypass and HTML Injection Vulnerabilities

SolarWinds Server & Application Monitor is prone to a security-bypass vulnerability and multiple HTML-injection vulnerabilities.

An attacker may leverage these issues to bypass certain security restrictions and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SolarWinds Server & Application Monitor versions prior to 6.0.2 are vulnerable.

SolarWinds Server & Application Monitor Security Bypass and HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

SolarWinds Server & Application Monitor Security Bypass and HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SolarWinds Server & Application Monitor Security Bypass and HTML Injection Vulnerabilities

References:

• Solarwinds SAM Multiple Vulnerabilities (Security-Assessment.com)
  
• SolarWinds Server & Application Monitor Version 6.0.2 (SolarWinds)
  
• SolarWinds Server and Application Monitor Homepage (SolarWinds)