VulnerabilityModified
CVE-2021-35228
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack.
MEDIUM 4.7EPSS 0.58%
Does this matter?
Lower severity and a low EPSS score (0.58%). Track it; it rarely justifies an emergency change on its own.
Description
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim.
- CVSS 3.1
- 4.7 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.58% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- solarwinds/database performance analyzer
- Source
- psirt@solarwinds.com
References
- https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2021-3-7438_release_notes.htmRelease Notes, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35228Vendor Advisory
- https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2021-3-7438_release_notes.htmRelease Notes, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35228Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.