Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability
CVE-2023-40062

8HIGH

Key Information:

Vendor
Solarwinds
Status
Solarwinds Platform
Vendor
CVE Published:
1 November 2023

Summary

The SolarWinds Platform is affected by a remote code execution vulnerability caused by an incomplete list of disallowed inputs. This flaw enables low-privileged users to execute arbitrary commands with SYSTEM privileges, posing serious security risks to system integrity and confidentiality. Organizations utilizing this platform should promptly review their security measures and ensure that they apply latest patches to mitigate potential exploitation.

Affected Version(s)

SolarWinds Platform 2023.3.1 and previous versions

References

https://documentation.solarwinds.com/en/success_center/hc...
https://www.solarwinds.com/trust-center/security-advisori...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative
.