Medium · 5.4 CVE-2022-36966 EUVD-2022-39623GHSA-259m-9wgg-gmjw

Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

Published Oct 20, 2022 · Updated May 7, 2025 · Assigned by SolarWinds

Vendor: SolarWinds Product: SolarWinds Platform

Description

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

Affected products

Vendor	Product	Affected	Fixed
SolarWinds	SolarWinds Platform	2022.3 and previous – < 2022.3	2022.3

References

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966