ZDI-24-913: SolarWinds Access Rights Manager deleteTransferFile Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability
This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.6. The following CVEs are assigned: CVE-2024-23468.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-913?
The severity of ZDI-24-913 is rated at 8.6 on the CVSS scale.
What software is affected by ZDI-24-913?
ZDI-24-913 affects SolarWinds Access Rights Manager.
How can I exploit ZDI-24-913?
ZDI-24-913 can be exploited by remote attackers to delete arbitrary files without authentication.
What are the potential impacts of ZDI-24-913?
The potential impacts of ZDI-24-913 include the disclosure of sensitive information and unauthorized file deletion.
How do I remediate ZDI-24-913?
To remediate ZDI-24-913, immediately update SolarWinds Access Rights Manager to the latest patched version.