Cyber Resilience

CVE-2024-23472

Critical

Published: 17 July 2024

Published
17 July 2024
Modified
26 February 2025
KEV Added
Patch
CVSS Score v3.1 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0746 92.0th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-23472 is a critical-severity Path Traversal (CWE-22) vulnerability in Solarwinds Access Rights Manager. Its CVSS base score is 9.6 (Critical).

Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

SolarWinds Access Rights Manager (ARM) contains a directory traversal vulnerability tracked as CVE-2024-23472 and assigned CWE-22. The flaw permits an authenticated user to read and delete arbitrary files within the ARM installation. It received a CVSS 3.1 score of 9.6 with an attack vector of adjacent network, low attack complexity, no required privileges, and impacts to confidentiality, integrity, and availability that affect the broader system scope.

An attacker who already possesses valid credentials can exploit the traversal condition over an adjacent network to access or remove sensitive files stored by the ARM application, potentially leading to unauthorized data exposure or disruption of access-rights management functions.

The vendor addressed the issue in the ARM 2024.3 release, as documented in the official release notes. The current EPSS score of 0.0746 shows no material increase since disclosure.

EU & UK References

Vulnerability details

SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read and delete files in ARM.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

solarwinds
access rights manager
≤ 2023.2.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References