PT-2024-7019 · Solarwinds · Solarwinds Web Help Desk

Guy Lederfein · Published 2024-10-15 · Updated 2026-03-15 · CVE-2024-28988

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk versions prior to 12.8.3 Hotfix 2

Description SolarWinds Web Help Desk is susceptible to a Java deserialization Remote Code Execution issue. Successful exploitation of this issue allows an unauthenticated attacker to execute arbitrary commands on the host machine. The vulnerability resides in the AjaxProxy component and involves improper deserialization of untrusted data. This flaw is actively exploited.

Recommendations Apply the hotfix released by SolarWinds for versions prior to 12.8.3 Hotfix 2.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-08272

CVE-2024-28988

ZDI-25-407

Affected Products

Solarwinds Web Help Desk

References · 54

• https://nvd.nist.gov/vuln/detail/CVE-2024-28988 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-407 · Security Note
• https://bdu.fstec.ru/vul/2024-08272 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28988 · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/CVE-2024-28988 · Vendor Advisory
• https://twitter.com/cyber_sec_raj/status/1971776856891551832 · Twitter Post
• https://twitter.com/CCBalert/status/1847299943976870196 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1r01b8s/top_10_trending_cves_09022026 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1np86p5/top_10_trending_cves_24092025 · Reddit Post
• https://twitter.com/AWNetworks/status/1848436479623635220 · Twitter Post
• https://twitter.com/fridaysecurity/status/1847098376069788046 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1rrmlre/top_10_trending_cves_12032026 · Reddit Post
• https://t.me/CVEtracker/31458 · Telegram Post
• https://twitter.com/CVEnew/status/1962631003643748633 · Twitter Post
• https://twitter.com/transilienceai/status/1859099820855599475 · Twitter Post