CVE-2024-23478

{"id": "CVE-2024-23478", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@solarwinds.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2024-02-15T21:15:09.867", "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-23478", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@solarwinds.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@solarwinds.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service, resulting in remote code execution.\n"}, {"lang": "es", "value": "Se descubri\u00f3 que SolarWinds Access Rights Manager (ARM) era susceptible a una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo. Si se explota, esta vulnerabilidad permite que un usuario autenticado abuse de un servicio de SolarWinds, lo que resulta en la ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2024-02-20T20:39:52.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:solarwinds:access_rights_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C08A49C-ABE0-488A-8F47-151E406D22D0", "versionEndExcluding": "2023.2.3"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@solarwinds.com"}