This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] SolarWinds Access Rights Manager version 2023.2.3 fixes 5 vulnerabilities

SolarWinds Access Rights Manager 2023.2.3 fixes 5 vulnerabilities [1].

SolarWinds ARM - RCE (CVE-2023-40057)
CVSS 9.0 (Critical)

An authenticated attacker on the local network can achieve remote code execution [2].

The vulnerability is present in product:

  • SolarWinds ARM; <2023.2.2

CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 15. 2. 2024.

SolarWinds ARM - RCE (CVE-2024-23476, CVE-2024-23479)
CVSS 9.6 (Critical)

An unauthenticated attacker on the local network can achieve remote code execution through directory traversal [3][4].

The vulnerability is present in product:

  • SolarWinds ARM; <2023.2.3

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 6. 2. 2024.

SolarWinds ARM - RCE (CVE-2024-23477)
CVSS 7.9 (High)

An unauthenticated attacker on the local network can achieve remote code execution through directory traversal [5].

The vulnerability is present in product:

  • SolarWinds ARM; <2023.2.3

CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 6. 2. 2024.

SolarWinds ARM - RCE (CVE-2024-23478)
CVSS 8.0 (High)

An authenticated attacker on the local network can abuse a SolarWinds service and subsequently achieve remote code execution [6].

The vulnerability is present in product:

  • SolarWinds; <2023.2.3

CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 6. 2. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 12. 4. 2024.

CESNET, z.s.p.o. Logo