PT-2022-23712 · Solarwinds · Solarwinds Platform

Asim Liaquat · Published 2022-08-16 · Updated 2025-05-07 · CVE-2022-36966

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SolarWinds Platform versions 2022.3 and previous

Description The issue is related to insufficient control on a URL parameter, causing an insecure direct object reference (IDOR) vulnerability. This allowed users with Node Management rights to view and edit all nodes.

Recommendations For SolarWinds Platform versions 2022.3 and previous, update to a version that includes a fix for the insecure direct object reference vulnerability. As a temporary workaround, consider restricting Node Management rights to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-36966

Affected Products

Solarwinds Platform

References · 10

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36966 · Security Note
• https://solarwinds.com/trust-center/security-advisories/CVE-2022-36966 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36966 · Vendor Advisory
• https://t.me/cvenotify/121299 · Telegram Post
• https://t.me/cvenotify/55713 · Telegram Post
• https://t.me/ckure/11705 · Telegram Post
• https://t.me/ckured/205 · Telegram Post
• https://t.me/cibsecurity/51910 · Telegram Post
• https://t.me/ckure/11867 · Telegram Post