CVE-2024-28992 HIGH

CVE-2024-28992: SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability

Vendor Solarwinds
Product Access Rights Manager
Weakness CWE-287 · Improper authentication
Published July 17, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

What the vulnerability does

01Description

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

Key dates

02Disclosure timeline

July 17, 2024 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2020-15240 Regression in JWT Signature Validation CVE-2022-42488 Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services. CVE-2021-26117 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVE-2024-10020 Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider CVE-2021-44759 Improper authentication vulnerability in TLS origin verification