Paper/Archive/CVE-2023-35182

CVE-2023-35182

SolarWinds Access Rights Manager — SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 85.5.855 × 2017.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.

Affected

ProductAffectedFixed inSource

Access Rights Managerprevious versions – 2023.2.0.73–CNA

access_rights_manager≤ 2023.2.0.73–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SolarWinds (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsolarwinds.com/trust-center/security-advisories/CVE-2023-35182 refdocumentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm