Skip to content
OpenAdvisories
Medium WID-SEC-2023-1889 5 CVEs

SolarWinds Platform: Mehrere Schwachstellen

Published Jul 25, 2023 · Updated Jul 25, 2023 · de-DE

Vendor: SolarWinds Product: Platform < 2023.3 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SolarWinds Platform ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen oder beliebigen Programmcode mit Rechten des Dienstes auszuführen.

Product

SolarWinds Platform (ehemals "Orion") ist eine IT Performance-Monitoring Plattform.

Vulnerabilities 5

  • High 7.2
    CVE-2023-23843

    SolarWinds Platform Incorrect Comparison Vulnerability

    The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands.

    SolarWinds SolarWinds Platform
  • High 7.2
    CVE-2023-23844

    SolarWinds Platform Incomplete List of Disallowed Inputs Vulnerability

    The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.

    SolarWinds SolarWinds Platform
  • High 7.2
    CVE-2023-33224

    SolarWinds Platform Incorrect Behavior Order Vulnerability

    The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.

    SolarWinds SolarWinds Platform
  • High 7.2
    CVE-2023-33225

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.

    SolarWinds SolarWinds Platform
  • Low 3.5
    CVE-2023-33229

    SolarWinds Platform Incorrect Input Neutralization Vulnerability

    The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML.

    SolarWinds SolarWinds Platform

Revision history

  1. #1

    Initiale Fassung

References