CVE-2023-40057

SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution

The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in remote code execution.

CVSS 3.1 · 9 Critical EPSS 4.9% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-40056

SolarWinds Platform SQL Injection Remote Code Execution Vulnerability

SQL Injection Remote Code Vulnerability was found in the SolarWinds Platform. This vulnerability can be exploited with a low privileged account.

CVSS 3.1 · 8 High EPSS 4.8% KEV · Not listed

Vendors

Solarwinds

Products

Solarwinds Platform

CVE-2023-40055

SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33227

CVSS 3.1 · 8 High EPSS 2.5% KEV · Not listed

Vendors

Solarwinds

Products

Network Configuration Manager

CVE-2023-40054

SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33226

CVSS 3.1 · 8 High EPSS 3.4% KEV · Not listed

Vendors

Solarwinds

Products

Network Configuration Manager

CVE-2023-40053

HTML injection Vulnerability in Serv-U 15.4

A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2023-3622

Access Control Bypass Vulnerability in the SolarWinds Platform

Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Solarwinds Platform

CVE-2023-35187

SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution.

CVSS 3.1 · 8.8 High EPSS 3.3% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-35186

SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.

CVSS 3.1 · 8 High EPSS 2.6% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-35185

SolarWinds Access Rights Manager OpenFile Directory Traversal Remote Code Execution Vulnerability

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-35184

SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a SolarWinds service resulting in a remote code execution.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-35183

SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability

The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-35182

SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-35181

SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability

The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-35180

SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API.

CVSS 3.1 · 8 High EPSS 28.8% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2023-35179

2FA/MFA Bypass Vulnerability in Serv-U 15.4

A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Solarwinds

Products

Serv-u

CVE-2023-33231

XSS in SolarWinds Database Performance Analyzer 2023.2

XSS attack was possible in DPA 2023.2 due to insufficient input validation

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Database Performance Analyzer

CVE-2023-33229

SolarWinds Platform Incorrect Input Neutralization Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Solarwinds Platform

CVE-2023-33228

SolarWinds Network Configuration Manager Sensitive Information Disclosure Vulnerability

The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Network Configuration Manager

CVE-2023-33227

Directory Traversal Remote Code Execution Vulnerability

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM privileges.

CVSS 3.1 · 8 High EPSS 2.2% KEV · Not listed

Vendors

Solarwinds

Products

Network Configuration Manager

CVE-2023-33226

Directory Traversal Remote Code Execution Vulnerability

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges.

CVSS 3.1 · 8 High EPSS 2.2% KEV · Not listed

Vendors

Solarwinds

Products

Network Configuration Manager