Lucene search

SolarWindsCVE-2024-28076

HistoryApr 18, 2024 - 9:15 a.m.

CVE-2024-28076

2024-04-1809:15:11

CWE-601

SolarWinds

web.nvd.nist.gov

solarwinds

platform

open redirection

vulnerability

arbitrary

domain

url parameter

nvd

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

AI Score

6.6

Confidence

Low

EPSS

0.001

Percentile

32.1%

JSON

The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL parameter with relative entry in the correct format

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SolarWinds Platform",
    "vendor": "SolarWinds ",
    "versions": [
      {
        "status": "affected",
        "version": "2024.1 and previous versions "
      }
    ]
  }
]

References

documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm

www.solarwinds.com/trust-center/security-advisories/cve-2024-28076

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

AI Score

6.6

Confidence

Low

EPSS

0.001

Percentile

32.1%

JSON

Related for CVE-2024-28076