PT-2023-27242 · Solarwinds · Solarwinds Access Rights Manager

Published 2023-12-21 · Updated 2024-02-02 · CVE-2023-40058

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SolarWinds Access Rights Manager (affected versions not specified)

Description Sensitive data was added to a public-facing knowledgebase, which could be exploited to access components of Access Rights Manager (ARM) if the threat actor is in the same environment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-40058

ZDI-24-008

Affected Products

Solarwinds Access Rights Manager

References · 6

• https://osv.dev/vulnerability/CVE-2023-40058 · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/CVE-2023-40058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40058 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-008 · Security Note
• https://twitter.com/CVEnew/status/1737875840635895910 · Twitter Post
• https://t.me/cvenotify/66075 · Telegram Post