cbcvebase.
CVE-2023-35180
published 2023-10-19

CVE-2023-35180: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds…

PriorityP271high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
27.37%
97.8th percentile
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API.

Affected

2 ranges
VendorProductVersion rangeFixed in
solarwindsaccess_rights_manager<= 2023.2.0.73—
solarwindsaccess_rights_managerprevious versions – 2023.2.0.73—

Detection & IOCsextracted from sources · hover to see the quote

  • →CVE-2023-35180 is one of eight high-severity vulnerabilities (CVE-2023-35180 through CVE-2023-35187) in SolarWinds Access Rights Manager (ARM) enabling privilege escalation, directory traversal, and remote code execution via abuse of the ARM API by authenticated users. ↗
  • ·CVE-2023-35180 requires authentication — exploitation is limited to authenticated users abusing the SolarWinds ARM API, not unauthenticated remote attackers. ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.