Skip to content
OpenAdvisories
High WID-SEC-2023-0392 6 CVEs

SolarWinds Orion: Mehrere Schwachstellen ermöglichen Codeausführung

Published Feb 14, 2023 · Updated Feb 14, 2023 · de-DE

Vendor: SolarWinds Product: Orion < 2023.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SolarWinds Orion ausnutzen, um beliebigen Programmcode auszuführen.

Product

SolarWinds Orion ist eine IT Performance-Monitoring Plattform.

Vulnerabilities 6

  • High 7.8
    CVE-2022-47506

    SolarWinds Platform Directory Traversal Vulnerability

    SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands.

    SolarWinds SolarWinds Platform
  • High 7.2
    CVE-2022-38111 EPSS 85%

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

    SolarWinds SolarWinds Platform
  • High 7.2
    CVE-2022-47503 EPSS 41%

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

    SolarWinds SolarWinds Platform
  • High 7.2
    CVE-2022-47504 EPSS 42%

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

    SolarWinds SolarWinds Platform
  • High 7.2
    CVE-2022-47507 EPSS 13%

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

    SolarWinds SolarWinds Platform
  • High 7.2
    CVE-2023-23836 EPSS 80%

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands.

    SolarWinds SolarWinds Platform

Revision history

  1. #1

    Initiale Fassung

References