Multiple vulnerabilities in SolarWinds Database Performance Analyzer

Published: 2023-01-23

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-38112 CVE-2022-38110
CWE-ID	CWE-312 CWE-79
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Database Performance Analyzer Server applications / Other server solutions
Vendor	SolarWinds

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Cleartext storage of sensitive information

EUVDB-ID: #VU71426

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-38112

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

the vulnerability exists due to software generates heap memory dumps with sensitive information in cleartext. A local user can obtain the heap memory dump and gain access to potentially sensitive data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Database Performance Analyzer: 2019.4 - 2022.4

CPE2.3

External links

https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38112

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site scripting

EUVDB-ID: #VU71425

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-38110

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Database Performance Analyzer: 2019.4 - 2022.4

CPE2.3

External links

https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38110

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.