Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
References
| Link | Resource |
|---|---|
| https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm | Release Notes Vendor Advisory |
| https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Oct 2022, 18:59
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:* cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:* cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:* cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:* cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:* cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:* cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:* cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:* cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:* |
|
| CWE | CWE-639 | |
| References | (CONFIRM) https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966 - Vendor Advisory | |
| References | (CONFIRM) https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm - Release Notes, Vendor Advisory |
20 Oct 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-20 21:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-36966
Mitre link : CVE-2022-36966
CVE.ORG link : CVE-2022-36966
JSON object : View
Products Affected
solarwinds
- orion_platform
CWE
CWE-639
Authorization Bypass Through User-Controlled Key