5.4

CVE-2022-36966

Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Solarwinds ≫ Orion Platform Version < 2020.2.6
Solarwinds ≫ Orion Platform Version 2020.2.6 Update -
Solarwinds ≫ Orion Platform Version 2020.2.6 Update hotfix1
Solarwinds ≫ Orion Platform Version 2020.2.6 Update hotfix2
Solarwinds ≫ Orion Platform Version 2020.2.6 Update hotfix3
Solarwinds ≫ Orion Platform Version 2020.2.6 Update hotfix4
Solarwinds ≫ Orion Platform Version 2020.2.6 Update hotfix5
Solarwinds ≫ Orion Platform Version 2022.2
Solarwinds ≫ Orion Platform Version 2022.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.362
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
psirt@solarwinds.com 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
Vendor Advisory
Release Notes
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966
Vendor Advisory