Lucene search
Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)ZDI-23-1565HistoryOct 19, 2023 - 12:00 a.m.
SolarWinds Access Rights Manager OpenFile Directory Traversal Remote Code Execution Vulnerability
2023-10-1900:00:00
Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)
www.zerodayinitiative.com
6
solarwinds
access rights manager
openfile
directory traversal
remote code execution
vulnerability
authentication
validation
user-supplied path
file operations
system context
0.001 Low
EPSS
Percentile
39.9%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpenFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
Related
cve
cve
CVE-2023-35185
2023-10-19 15:15:09
prion
prion
Directory traversal
2023-10-19 15:15:00
nvd
nvd
CVE-2023-35185
2023-10-19 15:15:09
cvelist
cvelist
thn
thn
Alert: PoC Exploits Released for Citrix and VMware Vulnerabilities
2023-10-25 04:47:00