CVE-2022-36966

Опубликовано: 20 окт. 2022

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.

Ссылки

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
Release Notes
Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966
Vendor Advisory
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
Release Notes
Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*

Версия до 2020.2.6 (исключая)

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.0032

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-639

Связанные уязвимости

GHSA-259m-9wgg-gmjw