SolarWinds Security Updates – 22 May 2024

The addressed vulnerabilities could allow the attacker to bypass security restrictions, overwrite arbitrary files, perform cross-site scripting attacks, or execute arbitrary code and gain access to the affected system.

Sample of the addressed vulnerabilities:

1. SolarWinds Access Rights Manager Code Execution (CVE-2024-28075):

• CVSS: 9
• Attack Vector: Adjacent Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Access

2. SolarWinds Access Rights Manager Security Bypass (CVE-2024-23473):

• CVSS: 8.6
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Bypass Security

Affected products:

• SolarWinds Platform 2024.1 and prior versions.
• Serv-U 15.4.2 and previous versions.
• SolarWinds Access Rights Manager (ARM) 2023.2.2.30 and prior versions.
• SolarWinds ARM 2023.2.3 and prior versions.
• SolarWinds Platform 2024.1 and previous versions.