Lucene search

SolarWindsCVELIST:CVE-2022-36960

HistoryNov 29, 2022 - 8:43 p.m.

CVE-2022-36960 SolarWinds Platform Improper Input Validation

2022-11-2920:43:38

CWE-20

CWE-287

SolarWinds

www.cve.org

solarwinds

cve-2022-36960

input validation

remote adversary

user privileges

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

55.4%

JSON

SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SolarWinds Platform",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThan": "2022.3",
        "status": "affected",
        "version": "2022.3 and prior versions",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Orion Platform",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThanOrEqual": "2020.2.6 HF5",
        "status": "affected",
        "version": "2020.2.6 HF5 and prior versions",
        "versionType": "custom"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

55.4%

JSON

Related for CVELIST:CVE-2022-36960