title: SolarWinds Network Configuration Manager Sensitive Information Disclosure Vulnerability
description: The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information.
problem types: CWE-311 Missing Encryption of Sensitive Data
affected:
{
defaultStatus: unaffected
product: Network Configuration Manager
vendor: SolarWinds
versions:
status: affected, version: 2023.3.1 and previous versions
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: All SolarWinds Network Configuration Manager customers are advised to upgrade to the latest version of the SolarWinds Network Configuration Manager version 2023.4