PT-2023-2038 · Solarwinds · Solarwinds Platform

Chudypb + 1 · Published 2023-02-15 · Updated 2023-10-27 · CVE-2022-47504

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SolarWinds Platform (affected versions not specified)

Description The issue is related to the Deserialization of Untrusted Data, allowing a remote adversary with admin-level account access to the SolarWinds Web Console to execute arbitrary commands. This can be exploited by an attacker to gain unauthorized access and control over the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-01755

CVE-2022-47504

ZDI-23-166

Affected Products

Solarwinds Platform

References · 11

• https://zerodayinitiative.com/advisories/ZDI-23-166 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-47504 · Security Note
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01755 · Security Note
• https://solarwinds.com/trust-center/security-advisories/CVE-2022-47504 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47504 · Vendor Advisory
• https://t.me/true_secator/4088 · Telegram Post
• https://t.me/cvenotify/44946 · Telegram Post
• https://t.me/cibsecurity/58278 · Telegram Post
• https://t.me/cvenotify/44397 · Telegram Post
• https://t.me/ckure/13115 · Telegram Post