Vulnerabilities

TI-2023-09644 CVE-2023-23845 · GHSA-4vhg-qvjq-w8m6

SolarWinds Platform Exposed Dangerous Method Vulnerability

MEDIUM 42

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05429 Published 2023-09-13 Fixed in 2023.3.1 CWE-697

TI-2023-09639 CVE-2023-23840 · GHSA-pg7c-4mvg-5fmj

SolarWinds Platform Exposed Dangerous Method Vulnerability

MEDIUM 42

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05429 Published 2023-09-13 Fixed in 2023.3.1 CWE-697

TI-2022-23586 CVE-2022-47509 · GHSA-v4fp-8r2g-99qq

SolarWinds Platform Incorrect Input Neutralization Vulnerability

LOW 28

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00511 Published 2023-04-21 No fix listed CWE-79

TI-2022-23582 CVE-2022-47505 · GHSA-jxw3-c37c-7rfx

SolarWinds Platform Local Privilege Escalation Vulnerability

LOW 36

The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00242 Published 2023-04-21 No fix listed CWE-269

TI-2022-17168 CVE-2022-36963 · GHSA-hqf7-473f-pm6r

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

MEDIUM 45

The SolarWinds Platform was susceptible to the Command Injection Vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.08153 Published 2023-04-21 No fix listed CWE-94

TI-2023-09635 CVE-2023-23836 · GHSA-6jmv-5f9v-pcqm

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

HIGH 74

SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.80298 Published 2023-02-15 No fix listed CWE-502

TI-2022-23584 CVE-2022-47507 · GHSA-x6f4-r93c-87xg

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

MEDIUM 48

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.12944 Published 2023-02-15 No fix listed CWE-502

TI-2022-23583 CVE-2022-47506 · GHSA-m2f7-63fv-7jcv

SolarWinds Platform Directory Traversal Vulnerability

LOW 37

SolarWinds Platform was susceptible to the Directory Traversal Vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00627 Published 2023-02-15 No fix listed CWE-22

TI-2022-23581 CVE-2022-47504 · GHSA-6542-mjh6-9g8w

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

MEDIUM 62

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.41939 Published 2023-02-15 No fix listed CWE-502

TI-2022-23580 CVE-2022-47503 · GHSA-3f6j-jq37-282h

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

MEDIUM 62

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.41047 Published 2023-02-15 No fix listed CWE-502

TI-2022-17818 CVE-2022-38111 · GHSA-xwrq-j8pg-pqxm

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

HIGH 75

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.84803 Published 2023-02-15 No fix listed CWE-502

TI-2022-17169 CVE-2022-36964 · GHSA-x499-m338-rw37

SolarWinds Platform Deserialization of Untrusted Data

MEDIUM 57

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.1775 Published 2022-11-29 No fix listed CWE-502

TI-2022-17167 CVE-2022-36962 · GHSA-pgg5-x7xr-3fmj

SolarWinds Platform Command Injection

MEDIUM 45

SolarWinds Platform was susceptible to Command Injection.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0937 Published 2022-11-29 No fix listed CWE-78

TI-2022-17165 CVE-2022-36960 · GHSA-m5r3-w5hq-w9c2

SolarWinds Platform Improper Input Validation

MEDIUM 42

SolarWinds Platform was susceptible to Improper Input Validation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00967 Published 2022-11-29 Fixed in 2022.3 CWE-20

TI-2022-17816 CVE-2022-38108 · GHSA-23mm-62vv-wv83

SolarWinds Platform Deserialization of Untrusted Data

HIGH 70

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.66597 Published 2022-10-20 No fix listed CWE-502

TI-2022-17164 CVE-2022-36958 · GHSA-3p56-mxjf-mfgp

SolarWinds Platform Deserialization of Untrusted Data

HIGH 81

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.81906 Published 2022-10-20 No fix listed CWE-502

TI-2022-17163 CVE-2022-36957 · GHSA-m3jh-mvm8-g729

SolarWinds Platform Deserialization of Untrusted Data

MEDIUM 49

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.14998 Published 2022-10-20 No fix listed CWE-502

TI-2022-17171 CVE-2022-36966 · GHSA-259m-9wgg-gmjw

Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

LOW 25

Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00508 Published 2022-10-20 Fixed in 2022.3 CWE-639

TI-2022-17166 CVE-2022-36961 · GHSA-g8wp-3x9j-448g

Orion Platform SQL Injection Privilege Escalation Vulnerability

HIGH 79

A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.7432 Published 2022-09-30 Fixed in 2022.2.3 CWE-89

TI-2021-14127 CVE-2021-35234 · GHSA-pw8x-9www-h93w

Exposed Dangerous Functions - Privileged Escalation

MEDIUM 43

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02888 Published 2021-12-20 Fixed in 2020.2.6 HF 3 CWE-89

TI-2021-14136 CVE-2021-35244 · GHSA-j7c8-fmh5-w5pf

Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6

MEDIUM 41

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05956 Published 2021-12-20 Fixed in 2020.2.6 HF 3 CWE-434

TI-2021-14140 CVE-2021-35248 · GHSA-qrg3-9cf5-hgw8

Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users

LOW 32

It has been reported that any Orion user, e.g.

CVSS 3.1MEDIUM 6.8 Adjacent network Low privileges No interaction EPSS 0.00915 Published 2021-12-20 Fixed in 2020.2.6 HF 3 CWE-732

TI-2021-14112 CVE-2021-35218 · GHSA-8j3p-xj5v-7gpf

Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

HIGH 78

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution.

CVSS 3.1HIGH 8.9 Adjacent network Low privileges No interaction EPSS 0.76411 Published 2021-09-01 Fixed in 2020.2.6 CWE-502

TI-2021-14109 CVE-2021-35215 · GHSA-qgvw-v9xq-rjp9

ActionPluginBaseView Deserialization of Untrusted Data RCE

HIGH 76

Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5.

CVSS 3.1HIGH 8.9 Adjacent network Low privileges No interaction EPSS 0.69941 Published 2021-09-01 Fixed in 2020.2.6 CWE-502

TI-2021-14131 CVE-2021-35238 · GHSA-p94g-5v88-v8wc

Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability

LOW 24

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.

CVSS 3.1MEDIUM 4.8 Adjacent network High privileges No interaction EPSS 0.01058 Published 2021-09-01 Fixed in 2020.2.6 HF1 CWE-79

Vulnerabilities

Filters