9.1

CVE-2024-28987

Warnung
Medienbericht

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Solarwinds ≫ Web Help Desk Version < 12.8.3
Solarwinds ≫ Web Help Desk Version12.8.3 Update-
Solarwinds ≫ Web Help Desk Version12.8.3 Updatehotfix1

15.10.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

Schwachstelle

SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 93.16% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
psirt@solarwinds.com 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2
Release Notes
https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
Vendor Advisory
https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/
Third Party Advisory
Press/Media Coverage
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987
US Government Resource