SolarWinds Access Rights Manager Flaw Let Attackers Execute Remote Code

IT and security directors can utilize SolarWinds Glean admission to Rights Supervisor (ARM) to efficiently arrange and audit user entry rights to recordsdata, systems, and recordsdata.

The tool affords an easy-to-use interface for provisioning, de-provisioning, and overseeing entry, which helps safeguard organizations from doable recordsdata loss and breaches.

Glean admission to Rights Supervisor 2023.2 turned into impacted with a few flaws that enable a a long way off attacker escalate privileges and assemble a long way off code.

Vulnerabilities Affected

CVE-2023-35180: A long way-off Code Execution Vulnerability

A A long way-off Code Execution Vulnerability had been detected in SolarWinds Glean admission to Rights Supervisor, which authenticated users can exploit to misuse the SolarWinds ARM API.

CVE-2023-35181: Privilege Escalation Vulnerability

There turned into a Privilege Escalation Vulnerability within the SolarWinds Glean admission to Rights Supervisor. This vulnerability befell due to incorrect folder permissions, enabling users to use and escalate their privileges.

CVE-2023-35182: A long way-off Code Execution Vulnerability

A vulnerability turned into original in SolarWinds Glean admission to Rights Supervisor that may perhaps perchance well enable a long way off code execution. Attackers no longer authenticated on the SolarWinds ARM Server can exploit this vulnerability to manufacture unauthorized entry to sensitive recordsdata or elevate out malicious actions.

CVE-2023-35183: Privilege Escalation Vulnerability

A Privilege Escalation Vulnerability turned into detected within the SolarWinds Glean admission to Rights Supervisor, which authenticated users may perhaps perchance well exploit to manufacture unauthorized privileges and entry to native sources. This vulnerability enables users to misuse native sources for privilege escalation.

CVE-2023-35184: A long way-off Code Execution Vulnerability

The SolarWinds Glean admission to Rights Supervisor turned into inclined to a A long way-off Code Execution exploit, allowing an attacker to assemble code remotely by abusing a SolarWinds carrier with out authentication.

CVE-2023-35185: A long way-off Code Execution Vulnerability

The SolarWinds Glean admission to Rights Supervisor turned into realized to salvage a vulnerability that allowed a long way off attackers to assemble arbitrary code by exploiting a directory traversal flaw. This flaw allowed attackers to manufacture SYSTEM privileges and potentially compromise the affected system.

CVE-2023-35186: A long way-off Code Execution Vulnerability

The SolarWinds Glean admission to Rights Supervisor had a flaw, allowing any individual to manipulate it from afar. This implies that any individual who turned into allowed to make use of SolarWinds may perhaps perchance well misuse it and make it enact issues it shouldn’t.

CVE-2023-35187: A long way-off Code Execution Vulnerability

A Directory Traversal A long way-off Code Vulnerability is susceptible to be exploited on SolarWinds Glean admission to Rights Supervisor with utilizing SYSTEM privileges.

“SolarWinds has developed a patch for these problems and communicated with possibilities referring to the steps wanted to practice the repair to harden their environments. We are going to no longer be responsive to any proof that any of these vulnerabilities had been exploited.” Solarwinds spokesperson acknowledged Cyber Security Recordsdata.