Lucene search
Piotr Bazydlo (@chudypb) of Trend Micro Zero Day InitiativeZDI-23-1584HistoryNov 06, 2023 - 12:00 a.m.
SolarWinds Orion Platform BlacklistedFilesChecker Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability
2023-11-0600:00:00
Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative
www.zerodayinitiative.com
4
solarwinds
orion platform
blacklistedfileschecker
remote code execution
vulnerability
authentication
incomplete list
disallowed inputs
system
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the BlacklistedFilesChecker class. The issue results from an incomplete list of disallowed inputs. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
Related
cve
cve
CVE-2023-40062
2023-11-01 16:15:08
cvelist
cvelist
prion
prion
Remote code execution
2023-11-01 16:15:00
nvd
nvd
CVE-2023-40062
2023-11-01 16:15:08
nessus
nessus
SolarWinds Platform 2023.3.x < 2023.4 Multiple Vulnerabilities
2023-11-03 00:00:00