Products
SolarWinds Access Rights Manager
Source
psirt@solarwinds.com
Tags
CVE-2024-28074 details
Published : July 17, 2024, 3:15 p.m.
Last Modified : July 17, 2024, 3:15 p.m.
Last Modified : July 17, 2024, 3:15 p.m.
Description
It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the researcher was able to bypass these and use a different method to exploit the vulnerability.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9.6 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. |
CVSS Data
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
9.6
Exploitability Score
2.8
Impact Score
6.0
Base Severity
CRITICAL
Vector String : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm | psirt@solarwinds.com |
This website uses the NVD API, but is not approved or certified by it.