Medium severity · published Aug 14, 2019
CVE-2018-19386
SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the…
6.1
CVSS
9%
EPSS
No
On KEV
Description
SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)9.0% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DP
Database Performance Analyzer · Solarwinds
11.1.457 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-19386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-19386
Exploit
https://i.imgur.com/Y7t2AD6.png
Exploit
https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5
More from Database Performance Analyzer
7.5
CVE-2023-23837
No exception handling vulnerability which revealed sensitive or excessive information to users
7.5
CVE-2022-38112
In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext
6.5
CVE-2023-23838
Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server
6.4
CVE-2025-26398
SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key
6.1
CVE-2023-33231
XSS attack was possible in DPA 2023.2 due to insufficient input validation