by Kastro
Paper/Archive/CVE-2024-23473

CVE-2024-23473

SolarWinds Access Rights Manager — SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 64.9.649 × 2013.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.

Affected

ProductAffectedFixed inSource
Access Rights Managerprevious versions – 2023.2.3–CNA
access_rights_manager≤ 2023.2.3–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SolarWinds (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsolarwinds.com/trust-center/security-advisories/CVE-2024-23473refdocumentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-4_release_notes.htm