CVE-2024-23479CWE-22

SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability

Critical Β· published February 15, 2024

CVSS v3.1
9.6
EPSS
6%
Percentile
93.1
In the wild
Unconfirmed
What it is

🚨 A single unauthenticated request is all it takes to execute arbitrary code on your system! This critical Directory Traversal vulnerability in SolarWinds Access Rights Manager (ARM) could let attackers waltz right in with zero credentials. πŸ”₯ Think of it like a delivery driver with a map that allows them to use shortcuts through back alleys β€” if they know the right paths, they can bypass all the secure entrances and deliver malicious packages straight to your server! πŸ“¦πŸ›‘οΈ If exploited, an attacker can achieve Remote Code Execution, potentially allowing them to install malware, steal sensitive data, or disrupt your entire system. The consequences could be absolutely devastating, leading to data breaches or catastrophic downtime for your organization.

Put simply

Think of it like a delivery driver with a map that allows them to use shortcuts through back alleys β€” if they know the right paths, they can bypass all the secure entrances and deliver malicious packages straight to your server! πŸ“¦πŸ›‘οΈ This Directory Traversal vulnerability in SolarWinds ARM lets unauthenticated users traverse directories and execute harmful commands on the server, as it fails to properly validate the paths being accessed.

What to do

If exploited, an attacker can achieve Remote Code Execution, potentially allowing them to install malware, steal sensitive data, or disrupt your entire system. The consequences could be absolutely devastating, leading to data breaches or catastrophic downtime for your organization. To protect yourself, patch to the latest version immediately. Review your security settings to ensure proper input validation is in place, and consider applying access controls to limit who can access critical system paths. You've got this! By taking these steps, you'll secure your system and keep those cyber villains at bay! πŸ¦Έβ€β™‚οΈπŸ›‘οΈ

The record
Technical detail
CVSS v3.1
9.6 Β· CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.05793 Β· 93.1th percentile
Weakness
CWE-22 Β· Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-02-15T20:34Z
EPSS history
Timeline
  • 15 FEB 20:34Z
    SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability
    cvelistv5