CVE-2024-29000: 
SolarWinds Platform vulnerability analysis and mitigation

CVE-2024-29000 is a reflected cross-site scripting (XSS) vulnerability affecting the SolarWinds Platform web console. The vulnerability was discovered in early 2024 and publicly disclosed on April 18, 2024. This vulnerability affects SolarWinds Platform 2024.1 and previous versions (SolarWinds Advisory).

The vulnerability is classified as a reflected cross-site scripting (CWE-79) issue affecting the web console interface. It has received a CVSS v3.1 base score of 7.9 (High) from SolarWinds, with the vector string CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. The NIST NVD assessment provides a different score of 4.3 (Medium) with the vector string CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD Database).

If successfully exploited, this vulnerability could allow an attacker to execute cross-site scripting attacks through the web console, potentially leading to unauthorized access to sensitive information or manipulation of web content. The vulnerability requires both high privileges and user interaction to be exploited (SolarWinds Advisory).

The vulnerability requires specific conditions to be exploited: a high-privileged user account and user interaction. The attack vector is adjacent (AV:A), indicating that the attack must be launched from the same shared network (NVD Database).

SolarWinds has released a fix for this vulnerability in SolarWinds Platform 2024.1 SR1 (Service Release 1). Users are advised to upgrade to this version to mitigate the vulnerability (Release Notes).