CVE-2024-28075: falha crítica em SolarWinds Access Rights Manager
SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
50Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9epss 78%
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.
We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
SolarWinds · Access Rights ManagerCVEs relacionadas — SolarWinds Access Rights Manager
No mesmo produto, das mais perigosas para as menos.
CVE-2024-23478HIGHSolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionEPSS 81.6%CVE-2023-35180HIGHSolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability EPSS 28.8%CVE-2024-23472CRITICALSolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure VulnerabilityEPSS 18.6%CVE-2024-23469CRITICALSolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 17.9%CVE-2024-28074CRITICALSolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability EPSS 10.9%CVE-2024-23477HIGHSolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution VulnerabilityEPSS 7.8%