Lucene search
Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)ZDI-23-1567HistoryOct 19, 2023 - 12:00 a.m.
SolarWinds Access Rights Manager OpenClientUpdateFile Directory Traversal Remote Code Execution Vulnerability
2023-10-1900:00:00
Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)
www.zerodayinitiative.com
11
solarwinds} {access rights manager} {remote code execution} {vulnerability} {directory traversal} {authentication bypass} {file operations} {arbitrary code execution} {system context
0.014 Low
EPSS
Percentile
86.6%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpenClientUpdateFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
Related
nvd
nvd
CVE-2023-35187
2023-10-19 15:15:09
prion
prion
Directory traversal
2023-10-19 15:15:00
cvelist
cvelist
cve
cve
CVE-2023-35187
2023-10-19 15:15:09
thn
thn
Alert: PoC Exploits Released for Citrix and VMware Vulnerabilities
2023-10-25 04:47:00