PT-2022-23708 · Unknown · Oroplatform

Published 2022-09-30 · Updated 2024-09-16 · CVE-2022-36961

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Orion Platform (affected versions not specified)

Description The issue concerns a vulnerable component of the Orion Platform that is susceptible to SQL Injection. An authenticated attacker could exploit this for privilege escalation or remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-36961

ZDI-22-1325

Affected Products

Oroplatform

References · 8

• https://solarwinds.com/trust-center/security-advisories/cve-2022-36961 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1325 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36961 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-3_release_notes.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36961 · Security Note
• https://t.me/cvenotify/94823 · Telegram Post
• https://t.me/cibsecurity/50780 · Telegram Post
• https://t.me/cvenotify/55717 · Telegram Post