ZDI-CAN-23060: ZDI-24-913: SolarWinds Access Rights Manager deleteTransferFile Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability
This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.6. The following CVEs are assigned: CVE-2024-23468.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23060?
The CVSS rating for ZDI-CAN-23060 is 8.6, indicating a high severity level.
How do I fix ZDI-CAN-23060?
To fix ZDI-CAN-23060, update SolarWinds Access Rights Manager to the latest version provided by the vendor.
What types of attacks can be executed via ZDI-CAN-23060?
ZDI-CAN-23060 allows remote attackers to delete arbitrary files and disclose sensitive information without authentication.
Which software is affected by ZDI-CAN-23060?
ZDI-CAN-23060 affects SolarWinds Access Rights Manager installations.
Is authentication required to exploit ZDI-CAN-23060?
No, authentication is not required to exploit the vulnerability ZDI-CAN-23060.