CVE-2018-19386

Published: Aug 14, 2019Updated: Nov 21, 2024 Sources: CVE List NVDCWE-79

6.1MEDIUM

NVD MITRE

Description

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.

In plain language

AI Worth attention

SolarWinds Database Performance Analyzer 11.1.457 can be used to show a fake or unsafe link to a user who opens an attacker-supplied page, so small businesses using this version should have IT investigate.

Executive summary

Reflected XSS in the idcStateError component reflects the page parameter into the “Try Again” button HREF, requiring user interaction to trigger.

If affected, business impact

Misleading staff promptsSession data exposureUnauthorized actions as usersAdministrative workflow disruption

What to do now

Check whether you run SolarWinds Database Performance Analyzer 11.1.457.
Ask your IT provider or SolarWinds whether a supported update fixes CVE-2018-19386; no fixed version is currently available in the findings.
Until confirmed, warn users not to open unexpected Database Performance Analyzer links, especially links that lead to an error page.

May need vendor / contractor work

What is it

This is a flaw in an error page that can turn part of a web address into a misleading link. It is like an attacker placing a convincing but altered “Try Again” sign inside a tool your staff trust, hoping someone follows it.

Who is affected

This matters to you if you run SolarWinds Database Performance Analyzer 11.1.457. The issue is a risk when a user opens an attacker-crafted link that reaches the affected error page.

How urgent is it

Public proof-of-concept exploits are available, making this an amber-priority issue even though it requires someone to open a crafted link. Review affected installations promptly and use the temporary safeguards while your IT provider confirms a supported fix.

What to do — in detail

Confirm the installed SolarWinds Database Performance Analyzer version and determine whether users can reach the idcStateError endpoint. The affected version identified is 11.1.457; the available findings do not identify fixed versions or supported upgrade branches, so obtain version-specific guidance from SolarWinds before changing releases.

If patching is delayed, reduce exposure to the affected web interface where practical and block or filter requests to /iwc/idcStateError.iwc containing an untrusted page parameter. Alert users not to follow unsolicited links to the application, and review web-server or application logs for unusual requests to that endpoint and unexpected page parameter values.

CVE-2018-19386 is not listed in CISA KEV, so no CISA KEV remediation due date applies.

Technical context

CVE-2018-19386 is CVSS 6.1 (Medium): CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. It is CWE-79 reflected XSS in SolarWinds Database Performance Analyzer 11.1.457, where the page parameter is reflected into the HREF for the “Try Again” button on /iwc/idcStateError.iwc. Two public exploits are known, but the findings do not confirm exploitation in the wild and the CVE is not in CISA KEV. EPSS predicts a 12.6% likelihood (96th percentile), with a falling trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.