Solarwinds Access Rights Manager vulnerabilities

CVE-2024-28990 [HIGH] CWE-798 CVE-2024-28990: SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication b SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this an

CVE-2024-23475 [HIGH] CWE-22 CVE-2024-23475: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclo The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

CVE-2024-28991 [HIGH] CWE-502 CVE-2024-28991: SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulner SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.

CVE-2024-23474 [HIGH] CWE-22 CVE-2024-23474: The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and I The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability.

CVE-2024-23468 [HIGH] CWE-22 CVE-2024-23468: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclo The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

CVE-2024-28992 [HIGH] CWE-287 CVE-2024-28992: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclo The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

CVE-2024-28993 [HIGH] CWE-22 CVE-2024-28993: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclo The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

CVE-2023-35181 [HIGH] CWE-276 CVE-2023-35181: The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vul The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation.

CVE-2023-35183 [HIGH] CWE-276 CVE-2023-35183: The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vul The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.

CVE-2021-35227 [HIGH] CWE-79 CVE-2021-35227: The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTP The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.

CVE-2023-35185 [MEDIUM] CWE-22 CVE-2023-35185: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerabil The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges.

CVE-2023-40058 [MEDIUM] CWE-200 CVE-2023-40058: Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to acc Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager (ARM) if the threat actor is in the same environment.