Remote Code Execution Vulnerability Affects SolarWinds ARM
Key Information
- Vendor
- Solarwinds
- Status
- Access Rights Manager
- Vendor
- CVE Published:
- 12 September 2024
Badges
Summary
Summary: SolarWinds has announced patches for a critical-severity remote code execution vulnerability in its Access Rights Manager software, marked as CVE-2024-28991. This flaw could allow authenticated users to abuse the service and execute arbitrary code on an affected system. Additionally, there is a hardcoded credential vulnerability (CVE-2024-28990) that could be exploited to bypass authentication and access the RabbitMQ management console. Both vulnerabilities were reported by Piotr Bazydlo and have been resolved in the Access Rights Manager version 2024.3.1. No known exploitations in the wild have been reported, and users are advised to update their installations as soon as possible.
Affected Version(s)
Access Rights Manager <= 2024.3
News Articles
Security Affairs CVE-2024-28991SolarWinds fixed critical RCE CVE-2024-28991 in Access Rights Manager
SolarWinds addressed a critical remote code execution vulnerability, tracked as CVE-2024-28991, in Access Rights Manager.
2 months ago
SolarWinds Patches Critical Vulnerability in Access Rights Manager
SolarWinds has announced patches for a critical-severity remote code execution vulnerability in Access Rights Manager.
2 months ago
CVSS V3.1
Timeline
Vulnerability started trending.
- 👾
Exploit exists.
First article discovered by SecurityWeek
Vulnerability published.
Vulnerability Reserved.