{
  "id": "CVE-2017-9538",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2017-10-03T01:29:03.310",
  "lastModified": "2018-10-09T20:01:45.323",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a \"Cannot exit above the top directory\" error message throughout the entire web application) via a \"..\" in the path field. In other words, the denial of service is caused by an incorrect implementation of a directory-traversal protection mechanism."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n \"Upload logo from external path\" de SolarWinds Network Performance Monitor en su versi\u00f3n 12.0.15300.90 permite que los atacantes remotos provoquen una denegaci\u00f3n de servicio (muestra permanente de un mensaje de error \"Cannot exit above the top directory\" en toda la aplicaci\u00f3n web) mediante un \"..\" en el campo path. En otras palabras, la denegaci\u00f3n de servicio es provocada por una implementaci\u00f3n incorrecta de un mecanismo de protecci\u00f3n contra saltos de directorio."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "acInsufInfo": true,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:solarwinds:network_performance_monitor:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "12.0.15300.90",
              "matchCriteriaId": "0F6998BB-854A-4CC9-A0F7-A70D49333DAD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.securityfocus.com/archive/1/541263/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/101066",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    }
  ]
}