CVE-2024-23476

CVE-2024-23476 refers to a Directory Traversal Remote Code Execution vulnerability in SolarWinds Access Rights Manager (ARM). The accessible documents describe an unauthenticated path-traversal flaw that can lead to remote code execution with high impact (CVE metrics show a CRITICAL base score, 9...

CVE-2024-23479

SolarWinds ARM is affected by CVE-2024-23479: a Directory Traversal Remote Code Execution vulnerability. The issue allows an unauthenticated attacker to achieve remote code execution via directory traversal in ARM. The vulnerability affects SolarWinds Access Rights Manager; however, the provided ...

CVE-2024-23478

CVE-2024-23478 affects SolarWinds Access Rights Manager (ARM). The connected advisories describe a deserialization/JsonSerializationBinder flaw that can allow an attacker to trigger remote code execution in ARM installations. The ZDI advisory specifies that authentication is required and attribut...

CVE-2024-23477

CVE-2024-23477 affects SolarWinds Access Rights Manager (ARM). The vulnerability is a Directory Traversal that enables unauthenticated remote code execution. Details across sources indicate exposed components (openServerFileStream) and that exploitability does not have published fix/version infor...

CVE-2024-28990

SolarWinds ARM contains a hard-coded credential authentication bypass (CVE-2024-28990) that could allow access to the RabbitMQ management console. The vulnerability affects ARM versions prior to 2024.3.1, and remediation is available in ARM 2024.3.1 (as referenced by multiple sources). No exploit...

CVE-2024-28991

SolarWinds ARM is affected by a remote code execution vulnerability (CVE-2024-28991) tied to the JsonSerializationBinder deserialization pathway. The issue allows an authenticated user to exploit ARM to execute arbitrary code on the server; authentication is required, but the vulnerability can be...

CVE-2024-28993

The CVE-2024-28993 entry concerns SolarWinds Access Rights Manager and describes a Directory Traversal and Information Disclosure vulnerability. An unauthenticated attacker could delete arbitrary files and leak sensitive information via this path traversal flaw. Multiple external sources (NVD/Red...

CVE-2024-28075

Summary: CVE-2024-28075 affects SolarWinds Access Rights Manager (ARM). The connected ZDI advisory and Nessus plugin confirm a deserialization flaw in the JsonSerializationBinder class that allows an authenticated, potentially bypassing authentication, attacker to execute arbitrary code on affect...

CVE-2023-40057

The vulnerability CVE-2023-40057 affects SolarWinds Access Rights Manager (ARM). Multiple connected sources describe a deserialization-based flaw that enables remote code execution when exploited by an authenticated user who abuses a SolarWinds service. The threat hinges on a Remote Code Executio...

CVE-2024-23473

CVE-2024-23473 affects SolarWinds Access Rights Manager (ARM). The connected documents describe a hard-coded credential authentication bypass that allows remote access to the RabbitMQ management console. The vulnerability arises from the RabbitMQ configuration using hard-coded credentials, enabli...