CVE-2023-35182

2023-10-1915:15:09

CWE-502

[email protected]

web.nvd.nist.gov

solarwinds

access rights manager

rce

vulnerability

unauthenticated users

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.034 Low

EPSS

Percentile

91.5%

JSON

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.

Affected configurations

NVD

Node

solarwindsaccess_rights_managerRange≤2023.2.0.73

CPENameOperatorVersion
solarwinds:access_rights_managersolarwinds access rights managerle2023.2.0.73

CPE	Name	Operator	Version
solarwinds:access_rights_manager	solarwinds access rights manager	le	2023.2.0.73

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Access Rights Manager",
    "vendor": "SolarWinds",
    "versions": [
      {
        "lessThanOrEqual": "2023.2.0.73",
        "status": "affected",
        "version": "previous versions",
        "versionType": "2023.2"
      }
    ]
  }
]