NVD Vulnerability Detail

CVE-2012-2576

Summary	SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field.
Publication Date	Dec. 21, 2017, 6:29 a.m.
Registration Date	Jan. 28, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 10:39 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:solarwinds:backup_profiler::::::::				5.1.2
cpe:2.3:a:solarwinds:storage_profiler::::::::				5.1.2
cpe:2.3:a:solarwinds:storage_manager::::::::				5.1.2

Related information, measures and tools

No	URL	タグ
1	http://www.exploit-db.com/exploits/18818	Exploit Third Party Advisory VDB Entry
2	http://www.exploit-db.com/exploits/18818	Exploit Third Party Advisory VDB Entry
3	http://www.exploit-db.com/exploits/18833	Exploit Third Party Advisory VDB Entry
4	http://www.exploit-db.com/exploits/18833	Exploit Third Party Advisory VDB Entry
5	http://www.securityfocus.com/bid/51639	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/51639	Third Party Advisory VDB Entry
7	http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/vulnerability.htm	Vendor Advisory
8	http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/vulnerability.htm	Vendor Advisory
9	https://exchange.xforce.ibmcloud.com/vulnerabilities/72680	Third Party Advisory VDB Entry
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/72680	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

JVN Vulnerability Information

複数の SolarWinds 製品における SQL インジェクションの脆弱性

Title	複数の SolarWinds 製品における SQL インジェクションの脆弱性
Summary	SolarWinds Storage Manager、SolarWinds Storage Profiler、および SolarWinds Backup Profiler には、SQL インジェクションの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 23, 2012, midnight
Registration Date	Jan. 26, 2018, 12:08 p.m.
Last Update	Jan. 26, 2018, 12:08 p.m.

Affected System

SolarWinds

SolarWinds Backup Profiler

SolarWinds Storage Profiler

Storage Resource Monitor (旧 SolarWinds Storage Manager)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-2576	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2576
National Vulnerability Database (NVD)
2	CVE-2012-2576	https://nvd.nist.gov/vuln/detail/CVE-2012-2576

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
SolarWinds
1	SW-07-001	http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/vulnerability.htm

その他

No	Name	URL
関連文書
1	SolarWinds Storage Manager Server SQL Injection Vulnerability	https://www.securityfocus.com/bid/51639/info

Change Log

No	Changed Details	Date of change
0	[2018年01月26日] 掲載	Feb. 17, 2018, 10:37 a.m.