CVE-2024-23476CWE-22

SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability

Critical · published February 15, 2024

CVSS v3.1
9.6
EPSS
7%
Percentile
94.2
In the wild
Unconfirmed
What it is

🚨 A sneaky path can lead any user to execute malicious code! The SolarWinds Access Rights Manager (ARM) is vulnerable to a Directory Traversal flaw that lets unauthenticated users tap into remote code execution — a recipe for disaster! 🔥 Think of it like a sneaky delivery driver who takes a wrong turn and ends up at the restricted area of a warehouse, delivering packages that shouldn’t be received there. This vulnerability opens the door for anyone with a clever enough address to access systems they shouldn’t be able to. If exploited, attackers could gain full control over your system, potentially leading to data breaches, unauthorized access, or even complete system compromise. Imagine the chaos of a thief running rampant through your digital estate, accessing sensitive information and causing absolute havoc!

Put simply

Think of it like a sneaky delivery driver who takes a wrong turn and ends up at the restricted area of a warehouse, delivering packages that shouldn’t be received there. This vulnerability opens the door for anyone with a clever enough address to access systems they shouldn’t be able to. This Directory Traversal vulnerability in SolarWinds ARM allows unauthenticated users to traverse directories and execute arbitrary code. Essentially, it tricks the system into running instructions that should be kept behind closed doors.

What to do

If exploited, attackers could gain full control over your system, potentially leading to data breaches, unauthorized access, or even complete system compromise. Imagine the chaos of a thief running rampant through your digital estate, accessing sensitive information and causing absolute havoc! To protect your systems, immediately patch to the latest version of SolarWinds Access Rights Manager and review your directory permissions. Additionally, employ stricter input validation to prevent unauthorized directory access. Don’t leave your digital doors wide open! You've got this! Take these steps to protect your network, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07080 · 94.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-02-15T20:35Z
EPSS history
Timeline
  • 15 FEB 20:35Z
    SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability
    cvelistv5