CVE-2024-28075: fallo crítico en SolarWinds Access Rights Manager
SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
50Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9epss 78%
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.
We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
SolarWinds · Access Rights ManagerCVEs relacionadas — SolarWinds Access Rights Manager
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-23478HIGHSolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionEPSS 81.6%CVE-2023-35180HIGHSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability EPSS 28.8%CVE-2024-23472CRITICALSolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure VulnerabilityEPSS 18.6%CVE-2024-23469CRITICALSolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 17.9%CVE-2024-28074CRITICALSolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability EPSS 10.9%CVE-2024-23477HIGHSolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution VulnerabilityEPSS 7.8%