SolarWinds Observability Self-Hosted DOM-Based Reflective Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in SolarWinds Observability Self-Hosted. This issue arises from an unsanitized field in the URL, allowing for DOM-based reflective XSS. The vulnerability affects authenticated users with administrator-level access. Exploitation of this vulnerability requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to upgrade to SolarWinds Observability Self-Hosted version 2025.2 or later, where this vulnerability has been fixed.