Unauthenticated Arbitrary File Deletion and Information Disclosure Vulnerability Affects SolarWinds Access Rights Manager
CVE-2024-23475
9.8CRITICAL
Summary
The SolarWinds Access Rights Manager is subject to a vulnerability that enables an unauthenticated user to exploit Directory Traversal, potentially leading to arbitrary file deletions and the exposure of sensitive information. This flaw poses a significant risk in environments where Access Rights Manager is deployed, as attackers could leverage it to manipulate access controls and gain unauthorized insights into sensitive data.
Affected Version(s)
Access Rights Manager previous versions <= 2023.2.4
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative