Disable NTLM: SAM 2022.4
CVE-2022-47508

7.5HIGH

Key Information:

Vendor
Solarwinds
Status
Server & Application Monitor (sam)
Vendor
CVE Published:
15 February 2023

Summary

A configuration issue has been identified in SolarWinds products where polling configured to utilize Kerberos unexpectedly results in NTLM traffic being processed in the environment. This occurs because data queries are executed via IP address instead of properly utilizing the Kerberos protocol, leading to potential unauthorized access or data exposure. Users should closely review their configurations to ensure secure connectivity protocols are enforced, minimizing risks associated with this vulnerability.

Affected Version(s)

Server & Application Monitor (SAM) 2022.4.1 and prior versions <= 2022.4.1

References

https://www.solarwinds.com/trust-center/security-advisori...
https://documentation.solarwinds.com/en/success_center/sa...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
.