title: Stored XSS in Maps text box hyperlink Vulnerability
description: A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
platforms: Windows
product: Orion Platform
vendor: SolarWinds
versions:
lessThan: 2020.2.6 HF1 , status: affected, version: 2020.2.6 and previous versions , versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
version: 3.1
]
solutions: SolarWinds recommends installing 2020.2.6 Hotfix 1 for the Orion Platform as soon as it becomes available. All customers should implement all the recommendations from the Orion Secure Configuration Guide.
workarounds: If you are unable to upgrade immediately. See SolarWinds Knowledgebase Article Below:
https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Stored-XSS-in-Maps-text-box-hyperlink-vulnerability-CVE-2021-35239?language=en_US