SolarWinds Security Updates – 16 February 2024

By /
  • 60/2024
  • Critical

SolarWinds has released security updates to address several vulnerabilities affecting SolarWinds Platform and SolarWinds Access Rights Manager (ARM).

The addressed vulnerabilities could allow the attacker to bypass security restrictions, or execute arbitrary code and gain access to the affected products by sending a specially crafted request.

Sample of the addressed vulnerabilities:

1. SolarWinds Access Rights Manager (ARM) Code Execution (CVE-2024-23476):

  • CVSS: 9.6
  • Attack Vector: Adjacent Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Gain Access

2. SolarWinds SQL Injection Remote Code Execution (CVE-2023-50395):

  • CVSS: 8
  • Attack Vector: Adjacent Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Gain Access

The affected products:

  • SolarWinds Access Rights Manager (ARM) 2023.2.2 and prior versions.
  • SolarWinds Platform 2023.4.2 and previous versions.
Vulnerabilities
  • CVE-2023-40057
  • CVE-2024-23476
  • CVE-2024-23477
  • CVE-2024-23478
  • CVE-2024-23479
  • CVE-2023-50395
  • CVE-2023-35188
  • CVE-2023-40058
  • CVE-2023-48795
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

SolarWinds Security Advisory

References

SolarWinds Security Advisory