Product:
Observability Self-Hosted
Summary
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, allowing an attacker to redirect a user to a malicious site. The attack complexity is high, and authentication is required.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-40545 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL that manipulates the redirection string. By tricking a user into clicking the link, the attacker can redirect the user to a site of their choosing. This requires the attacker to have access to the same network as the target and the user must be authenticated.
Affected Products
- SolarWinds Observability Self-Hosted: Vulnerable to open redirection due to improper URL sanitization.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that all URLs are properly sanitized before processing. Users should also be cautious of links they click on and ensure they are accessing trusted sites.