9.8crit
CVE-2019-8917in critical feed
SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
36.4%
percentile 98%
Public exploits
0
none known
Summary
SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may be abused by an attacker to execute commands as the SYSTEM user.
Exploit prediction (EPSS)
36.45% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
- securityfocus.com /bid/107061 · vdb-entry, x_refsource_BID, x_transferred
- github.com /VerSprite/research/blob/master/advisories/VS-2019-001.md · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-8917
- NVD: CVE-2019-8917
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.