CVE-2024-28990CWE-798

SolarWinds Access Rights Manager (ARM) Hardcoded Credentials Authentication Bypass Vulnerability

Medium · published September 12, 2024

CVSS v3.1
6.3
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console.

We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-09-12T13:16Z
EPSS history
Timeline
  • 12 SEP 13:16Z
    SolarWinds Access Rights Manager (ARM) Hardcoded Credentials Authentication Bypass Vulnerability
    cvelistv5