Lucene search

SolarWindsCVELIST:CVE-2024-28991

HistorySep 12, 2024 - 1:17 p.m.

CVE-2024-28991 SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution

2024-09-1213:17:30

CWE-502

SolarWinds

www.cve.org

solarwinds

arm

vulnerability

remote code execution

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

20.0%

JSON

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Access Rights Manager",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThanOrEqual": "2024.3",
        "status": "affected",
        "version": "previous versions",
        "versionType": "2024.3"
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3-1_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/CVE-2024-28991

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

20.0%

JSON

Related for CVELIST:CVE-2024-28991