What is CVE-2022-36965?

CVE-2022-36965 is a medium-severity vulnerability in Solarwinds Orion Platform, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2022-09-30.

How severe is CVE-2022-36965?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Is CVE-2022-36965 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Solarwinds Orion Platform

CVE-2022-36965

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (44.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Solarwinds Orion Platform — versions 2020.2.6 and previous versions
Solarwinds Solarwinds_platform

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

karimhabush/cyberowl

References

psirt@solarwinds.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@solarwinds.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2022-36965?: CVE-2022-36965 is a medium-severity vulnerability in Solarwinds Orion Platform, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2022-09-30.
How severe is CVE-2022-36965?: Medium severity. CVSS v3 base score is 6.1 out of 10.
Is CVE-2022-36965 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.