cbcvebase.
CVE-2023-35187
published 2023-10-19

CVE-2023-35187: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to…

PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.97%
85.5th percentile
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution.

Affected

2 ranges
VendorProductVersion rangeFixed in
solarwindsaccess_rights_manager<= 2023.2.0.73—
solarwindsaccess_rights_managerprevious versions – 2023.2.0.73—

Detection & IOCsextracted from sources · hover to see the quote

  • →Patch baseline: SolarWinds Access Rights Manager version 2023.2.1 addresses this vulnerability — flag any installations running versions prior to 2023.2.1 ↗
  • ·SolarWinds rated this vulnerability 8.8 (high) internally, while NVD/ZDI rate it 9.8 (critical) — detection prioritization should use the higher score given unauthenticated SYSTEM-level RCE impact ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.