CVE-2022-38110

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SolarWinds	Database Performance Analyzer (DPA)	>= SolarWinds, <= 2022.4

References

https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38110Release Notes, Vendor Advisory
https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38110Release Notes, Vendor Advisory

Timeline

Published: Jan 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-381117.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-381127.5In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.CVE-2022-381135.3This vulnerability discloses build and services versions in the server response header.CVE-2022-381146.1This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request sm CVE-2022-381155.3Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT CVE-2022-381169.8Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticate CVE-2022-381176.1Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to CVE-2022-381188.8OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform CVE-2022-381199.8UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authe CVE-2022-38126.5A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::A CVE-2022-381206.5UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass auth CVE-2022-381216.5UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege c