CVE-2022-38108

Опубликовано: 20 окт. 2022

Источник: nvd

CVSS3: 7.2

EPSS Высокий

Описание

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

Ссылки

http://packetstormsecurity.com/files/171567/SolarWinds-Information-Service-SWIS-Remote-Command-Execution.html
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38108
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-CAN-17531
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/171567/SolarWinds-Information-Service-SWIS-Remote-Command-Execution.html
https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38108
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-CAN-17531
Third Party Advisory
VDB Entry
https://packetstorm.news/files/id/171567

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:*

Версия до 2020.2.6 (исключая)

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:-:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix1:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix2:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix3:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix4:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2020.2.6:hotfix5:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2022.2:*:*:*:*:*:*:*

cpe:2.3:a:solarwinds:orion_platform:2022.3:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.86245

Высокий

7.2 High

CVSS3

Дефекты

CWE-502

Связанные уязвимости

GHSA-23mm-62vv-wv83