CVE-2023-23836: SolarWinds Platform Deserialization of Untrusted Data Vulnerability

Published Feb 15, 2023

Updated

SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands.

Affected Software

1 affected component

SolarWinds Orion Platform=2022.4.1

Remediation

Information

All SolarWinds Platform customers are advised to upgrade to the latest version of the SolarWinds Platform version 2023.1.

Event History

Feb 15, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-23836?

CVE-2023-23836 is a vulnerability in SolarWinds Platform version 2022.4.1 that allows a remote adversary with Orion admin-level account access to execute arbitrary commands.

How severe is CVE-2023-23836?

CVE-2023-23836 has a severity rating of 7.2, which is considered high.

How can I fix CVE-2023-23836?

To fix CVE-2023-23836, it is recommended to update the SolarWinds Platform to a version that is not affected by this vulnerability.

Where can I find more information about CVE-2023-23836?

You can find more information about CVE-2023-23836 in the SolarWinds Platform release notes and the SolarWinds security advisories.

What is the CWE ID for CVE-2023-23836?

The CWE ID for CVE-2023-23836 is 502.