Database Performance Analyzer
CVE-2023-33231
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
XSS attack was possible in DPA 2023.2 due to insufficient input validation
AnalysisAI
XSS attack was possible in DPA 2023.2 due to insufficient input validation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. XSS attack was possible in DPA 2023.2 due to insufficient input validation Affected products include: Solarwinds Database Performance Analyzer.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
No exception handling vulnerability which revealed sensitive or excessive information to users. Rated high severity (CVS
Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the serv
Stored cross-site scripting in SolarWinds Database Performance Analyzer enables a highly privileged, adjacent-network at
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from header
SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. Rated medium severity (CVS
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today