Lucene search

SolarWindsCVELIST:CVE-2024-28076

HistoryApr 18, 2024 - 9:05 a.m.

CVE-2024-28076 SolarWinds Platform Arbitrary Open Redirection Vulnerability

2024-04-1809:05:42

CWE-601

SolarWinds

www.cve.org

solarwinds

platform

redirection

vulnerability

arbitrary

domain

url parameter

7 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.1%

JSON

The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL parameter with relative entry in the correct format

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SolarWinds Platform",
    "vendor": "SolarWinds ",
    "versions": [
      {
        "status": "affected",
        "version": "2024.1 and previous versions "
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/cve-2024-28076

7 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.1%

JSON

Related for CVELIST:CVE-2024-28076