CVE-2019-17127: XSS

Published Jan 17, 2020

Updated

A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation.

Affected Software

1 affected component

SolarWinds Orion Platform=2019.2-hotfix1

Event History

Jan 17, 2020

CVE Published

via MITRE·05:44 PM

Data Sourced

via MITRE·05:44 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2019-17127.

What is the severity of CVE-2019-17127?

The severity of CVE-2019-17127 is medium (6.1).

What is the description of CVE-2019-17127?

CVE-2019-17127 is a Stored Client Side Template Injection (CSTI) vulnerability with Angular in the SolarWinds Orion Platform 2019.2 HF1, which allows an attacker to inject an Angular expression and escape the Angular sandbox to achieve stored XSS, potentially leading to privilege escalation.

Which software is affected by CVE-2019-17127?

The SolarWinds Orion Platform 2019.2 HF1 with hotfix 1 is affected by CVE-2019-17127.

How can an attacker exploit CVE-2019-17127?

An attacker can exploit CVE-2019-17127 by injecting an Angular expression and escaping the Angular sandbox to achieve stored XSS.