by Kastro
Paper/Archive/CVE-2024-23472

CVE-2024-23472

SolarWinds Access Rights Manager — SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability

EPSS 19%CVSS 9.6
critical.is priorityof 100
48
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 97.3.973 × 2019.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read and delete files in ARM.

Affected

ProductAffectedFixed inSource
Access Rights Managerprevious versions – 2023.2.4–CNA
access_rights_manager≤ 2024.3–CISA-ADP

Scores by source

SolarWinds (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdocumentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm