CVE-2019-12864

MEDIUM

SolarWinds Orion Platform 2018.4 HF3 - Information Leakage via Error Stack Trace

Title source: llm

Description

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://www.solarwinds.com/network-performance-monitor

Exploit, Third Party Advisory x_refsource_misc

https://www.esecforte.com/network-performance-monitor-india-esec-forte-technologies/

Scores

CVSS v3 5.5

EPSS 0.0022

EPSS Percentile 44.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-209

Status published

Products (3)

solarwinds/netpath 1.1.4

solarwinds/network_performance_monitor 12.4

solarwinds/orion_platform 2018.4 hotfix3

Published May 04, 2020

Tracked Since Feb 18, 2026