CVE-2019-20002: High severity solarwinds vulnerability

Published Apr 27, 2020

Updated

Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=group TSV export by an admin user.

Affected Software

1 affected component

SolarWinds WebHelpDesk=12.7.1

Event History

Apr 27, 2020

CVE Published

via MITRE·02:29 PM

Data Sourced

via MITRE·02:29 PM

Description

Frequently Asked Questions

What is the severity of CVE-2019-20002?

CVE-2019-20002 has a medium severity rating due to the risk of formula injection attacks affecting data integrity.

How do I fix CVE-2019-20002?

To fix CVE-2019-20002, update to the latest version of SolarWinds WebHelpDesk that addresses this vulnerability.

Who is affected by CVE-2019-20002?

CVE-2019-20002 affects users of SolarWinds WebHelpDesk version 12.7.1.

What is formula injection in the context of CVE-2019-20002?

Formula injection in CVE-2019-20002 refers to the unauthorized manipulation of exported data through help request form inputs.

Can a low-privileged user trigger CVE-2019-20002?

Yes, a low-privileged user can trigger CVE-2019-20002 by inputting values in the Subject field of the help request form.