ZDI-24-909: SolarWinds Access Rights Manager ExpandZipFile Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 10.0. The following CVEs are assigned: CVE-2024-23467.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-909?
The severity of ZDI-24-909 is rated 10.0 on the CVSS scale, indicating critical risk.
How do I fix ZDI-24-909?
To fix ZDI-24-909, it is essential to apply the latest security patches provided by SolarWinds for Access Rights Manager.
Who can exploit ZDI-24-909?
ZDI-24-909 can be exploited by remote attackers without authentication.
What does ZDI-24-909 allow an attacker to do?
ZDI-24-909 allows attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager.
What versions of SolarWinds Access Rights Manager are affected by ZDI-24-909?
All versions of SolarWinds Access Rights Manager are likely affected by ZDI-24-909.