CVE-2022-36964: SolarWinds Platform Deserialization of Untrusted Data
Published Nov 29, 2022
·Updated
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
Affected Software
9 affected components
SolarWinds Orion Platform<2020.2.6
SolarWinds Orion Platform=2020.2.6
SolarWinds Orion Platform=2020.2.6-hotfix1
SolarWinds Orion Platform=2020.2.6-hotfix2
SolarWinds Orion Platform=2020.2.6-hotfix3
SolarWinds Orion Platform=2020.2.6-hotfix4
SolarWinds Orion Platform=2020.2.6-hotfix5
SolarWinds Orion Platform=2022.2
SolarWinds Orion Platform=2022.3
Remediation
Information
All SolarWinds Platform customers are advised to upgrade to the latest version of the SolarWinds Platform version 2022.4
Event History
Nov 29, 2022
CVE Published
via MITRE·08:47 PM
Data Sourced
via MITRE·08:47 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2022-36964?
CVE-2022-36964 is a vulnerability in the SolarWinds Platform that allows a remote adversary to execute arbitrary commands.
2
How does CVE-2022-36964 impact the SolarWinds Platform?
CVE-2022-36964 allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
3
What is the severity of CVE-2022-36964?
CVE-2022-36964 has a severity rating of 8.8, which is classified as high.
4
Which versions of the SolarWinds Orion Platform are affected by CVE-2022-36964?
CVE-2022-36964 affects SolarWinds Orion Platform versions 2020.2.6, 2022.2, and 2022.3.
5
How can I fix CVE-2022-36964 in the SolarWinds Platform?
To fix CVE-2022-36964, update the affected SolarWinds Orion Platform installations to a version that includes the necessary security patches.