SolarWinds Platform SQL Injection Remote Code Execution Vulnerability
CVE-2023-50395
8.8HIGH
Summary
A SQL Injection vulnerability has been identified in the SolarWinds Platform, which may allow for remote code execution under specific conditions. This issue involves flawed update statements that can be exploited by an authenticated user, potentially leading to unauthorized actions within the system. Users should review their security measures and apply relevant updates to mitigate risks associated with this vulnerability.
Affected Version(s)
SolarWinds Platform 2023.4.2 and previous version
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative