CVE-2024-28074: falha crítica em SolarWinds Access Rights Manager
SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.6epss 11%
It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the researcher was able to bypass these and use a different method to exploit the vulnerability.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
SolarWinds · Access Rights ManagerCVEs relacionadas — SolarWinds Access Rights Manager
No mesmo produto, das mais perigosas para as menos.
CVE-2024-23478HIGHSolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionEPSS 81.6%CVE-2024-28075CRITICALSolarWinds ARM Deserialization of Untrusted Data Remote Code ExecutionEPSS 78.0%CVE-2023-35180HIGHSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability EPSS 28.8%CVE-2024-23472CRITICALSolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure VulnerabilityEPSS 18.6%CVE-2024-23469CRITICALSolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 17.9%CVE-2024-23477HIGHSolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution VulnerabilityEPSS 7.8%