Lucene search

SolarWindsCVE-2024-28991

HistorySep 12, 2024 - 2:16 p.m.

CVE-2024-28991

2024-09-1214:16:06

CWE-502

SolarWinds

web.nvd.nist.gov

solarwinds

arm

remote code execution

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.

Affected configurations

Nvd

Node

solarwindsaccess_rights_managerRange<2024.3.1

VendorProductVersionCPE
solarwindsaccess_rights_manager*cpe:2.3:a:solarwinds:access_rights_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
solarwinds	access_rights_manager	*	cpe:2.3:a:solarwinds:access_rights_manager::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Access Rights Manager",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThanOrEqual": "2024.3",
        "status": "affected",
        "version": "previous versions",
        "versionType": "2024.3"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3-1_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/CVE-2024-28991

Social References

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

Related for CVE-2024-28991