CVE-2024-28074: SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability
Published Jul 17, 2024
·Updated
It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the researcher was able to bypass these and use a different method to exploit the vulnerability.
Affected Software
1 affected component
SolarWinds Access Rights Manager<=2023.2.4
Remediation
Information
All SolarWinds Access Rights Manager customers are advised to upgrade to the latest version of the SolarWinds Access Rights Manager 2024.3
Event History
Jul 17, 2024
CVE Published
via MITRE·02:29 PM
Data Sourced
via MITRE·02:29 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Jul 18, 2024
News Published
via BleepingComputer·03:51 PM
News Published
via BleepingComputer·03:52 PM
Jul 24, 57160
Event
via MITRE·01:20 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-28074?
CVE-2024-28074 is classified as a medium severity vulnerability.
2
How do I fix CVE-2024-28074?
To remediate CVE-2024-28074, upgrade SolarWinds Access Rights Manager to version 2024.3 or later.
3
Which versions of SolarWinds Access Rights Manager are affected by CVE-2024-28074?
CVE-2024-28074 affects all versions of SolarWinds Access Rights Manager up to and including 2023.2.4.
4
What type of vulnerability is CVE-2024-28074?
CVE-2024-28074 is an access control vulnerability that allows for exploitation by bypassing implemented security measures.
5
Was CVE-2024-28074 previously disclosed?
Yes, CVE-2024-28074 is a follow-up to a previously reported vulnerability that was not completely fixed.