search menu icon-carat-right cmu-wordmark

CERT Coordination Center

SolarWinds Orion IPAM web interface reflected xss vulnerability

Vulnerability Note VU#203844

Original Release Date: 2012-10-31 | Last Revised: 2012-10-31


SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability.


CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. It has been reported that input fields are not sanitized allowing for authenticated users to execute scripts against the SolarWinds Orion IPAM web interface

Attack scenario:
1. http://[server name]/Orion/IPAM/IPAMSummaryView.aspx
2. Enter the following in the "Search for an IP address" field: "></script><script>alert('hi')</script>
3. Click Search, which will redirect you to the following URL:http://[server name]/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E


An attacker with access to the SolarWinds Orion IPAM web interface can conduct a reflected cross-site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.


Apply Hotfix

The vendor has stated this vulnerability has been addressed in IPAM-v3.0-HotFix1. Users are advised to apply the hotfix. The vendor has stated this hotfix will be incorporated in the next version of IPAM v3.1, due this quarter and that customers under maintenance can get access to this hot fix via their SolarWinds Customer Portal.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the SolarWinds Orion IPAM web interface using stolen credentials from a blocked network location.

Vendor Information



Notified:  August 02, 2012 Updated: October 31, 2012



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

    CVSS Metrics

    Group Score Vector
    Base 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N
    Temporal 2.7 E:POC/RL:W/RC:UC
    Environmental 0.9 CDP:L/TD:L/CR:ND/IR:ND/AR:ND



    Thanks to Anthony Trummer for reporting this vulnerability.

    This document was written by Michael Orlando.

    Other Information

    CVE IDs: CVE-2012-4939
    Date Public: 2012-10-31
    Date First Published: 2012-10-31
    Date Last Updated: 2012-10-31 14:32 UTC
    Document Revision: 11

    Sponsored by CISA.