CVE-2024-28992 - SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability

Back Back to CVE browser

HIGH

SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability

Published Jul 17, 2024

8.3

HIGH

CVSS 3.1

EPSS 1.89%

Description

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

Affected products

Vendor SolarWinds Product Access Rights Manager Default
affected
- Version
  previous versions
  Status
  affected
  Constraints
  <=2023.2.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SolarWinds

Access Rights Manager

affected

Version	Status	Constraints
previous versions	affected	<=2023.2.4

Remediation

Vendor solution

All SolarWinds Access Rights Manager customers are advised to upgrade to the latest version of the SolarWinds Access Rights Manager 2024.3

Weaknesses (2)

CWE-22

Path Traversal

CWE-287

Improper Authentication

References (1)

https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm
Release NotesVendor Advisory

Link	Providers	Tags
https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm		Release NotesVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner SolarWinds

Published Jul 17, 2024

Updated Aug 2, 2024

Reserved Mar 13, 2024

Link CVE-2024-28992

CISA Vulnrichment

Updated Jul 23, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-28992

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-28992