CVE-2024-28075

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28075
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.

9.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-4_release_notes.htm Release Notes
https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm Product
https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28075 Vendor Advisory
https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-4_release_notes.htm Release Notes
https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm Product
https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28075 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:solarwinds:access_rights_manager:*:*:*:*:*:*:*:*
History

10 Feb 2025, 22:49

Type Values Removed Values Added
References () https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-4_release_notes.htm - () https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-4_release_notes.htm - Release Notes
References () https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm - () https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm - Product
References () https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28075 - () https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28075 - Vendor Advisory
First Time Solarwinds
Solarwinds access Rights Manager
CPE cpe:2.3:a:solarwinds:access_rights_manager:*:*:*:*:*:*:*:*

21 Nov 2024, 09:05

Type Values Removed Values Added
References () https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-4_release_notes.htm - () https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-4_release_notes.htm -
References () https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm - () https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm -
References () https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28075 - () https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28075 -
Summary
  • (es) SolarWinds Access Rights Manager era susceptible a una vulnerabilidad de ejecución remota de código. Esta vulnerabilidad permite que un usuario autenticado abuse del servicio SolarWinds, lo que resulta en la ejecución remota de código. Agradecemos a Trend Micro Zero Day Initiative (ZDI) por su asociación continua para coordinar con SolarWinds la divulgación responsable de esta y otras vulnerabilidades potenciales.

14 May 2024, 15:13

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 15:13

Updated : 2025-02-10 22:49

NVD link : CVE-2024-28075

Mitre link : CVE-2024-28075

CVE.ORG link : CVE-2024-28075

JSON object : View

Products Affected

solarwinds

  • access_rights_manager
CWE
CWE-502

Deserialization of Untrusted Data