CVE-2022-38108CWE-502

SolarWinds Platform Deserialization of Untrusted Data

High · published October 20, 2022

Patch now

High probability of exploitation

CVSS calls it high at 7.2. It sits in the 99.3th percentile for exploit probability.

CVSS v3.1

7.2

EPSS

66%

Percentile

99.3

In the wild

Unconfirmed

What it is

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.65931 · 99.3th percentile
Weakness: CWE-502 · Deserialization of Untrusted Data
Published: 2022-10-20T20:11Z

EPSS history

Timeline

20 OCT 20:11Z
SolarWinds Platform Deserialization of Untrusted Data
cvelistv5