This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] SolarWinds fixes several vulnerabilities

SolarWinds fixes several vulnerabilities in its products, one of them critical. Products and their fixes: SolarWinds Web Help Desk - 12.8.3 HF3 [1] SolarWinds Platform - 2024.4 [2][3] SolarWinds Serv-U - 15.5 [4][5] SolarWinds Kiwi CatTools - 3.12.4 [6]

SolarWinds Web Help Desk - remote code execution (CVE-2024-28988)
CVSS 9.8 (Critical)

An unauthenticated remote attacker is able to achieve remote code execution in Web Help Desk [1].

The vulnerability is present in product:

  • SolarWinds Web Help Desk; <=12.8.3HF2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 15. 10. 2024.

SolarWinds Platform - privilege escalation (CVE-2024-45710)
CVSS 7.8 (High)

An authenticated local attacker is able to escalate their privileges in Platform [2].

The vulnerability is present in product:

  • SolarWinds Platform; <=2024.2.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 17. 10. 2024.

SolarWinds Serv-U - remote code execution (CVE-2024-45711)
CVSS 7.5 (High)

An authenticated remote attacker is able to achieve remote code execution in Serv-U [4].

The vulnerability is present in product:

  • SolarWinds Serv-U; <=15.4.2

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-45711 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 16. 10. 2024.

SolarWinds Platform - cross-site scripting (CVE-2024-45715)
CVSS 7.1 (High)

An authenticated attacker on the local network is able to carry out an XSS attack in Platform [3].

The vulnerability is present in product:

  • SolarWinds Platform; <=2024.2.1

CVSS: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

More information:

  • CVE-2024-45715 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 17. 10. 2024.

SolarWinds Serv-U - cross site scripting (CVE-2024-45714)
CVSS 5.7 (Medium)

An authenticated attacker on the local network is able to modify a variable containing a payload in Serv-U [5].

The vulnerability is present in product:

  • SolarWinds Serv-U; <=15.4.2.3

CVSS: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

More information:

  • CVE-2024-45714 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 16. 10. 2024.

SolarWinds Kiwi CatTools - sensitive information disclosure (CVE-2024-45713)
CVSS 5.1 (Medium)

An authenticated local attacker is able to obtain sensitive information in Kiwi CatTools if a non-default troubleshooting setting has been enabled [6].

The vulnerability is present in product:

  • SolarWinds Kiwi CatTools; <=3.12

CVSS: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L

More information:

The vulnerability was publicly disclosed 16. 10. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 30. 10. 2024.

CESNET, z.s.p.o. Logo