CVE-2024-23472
Published: 17 July 2024
Summary
CVE-2024-23472 is a critical-severity Path Traversal (CWE-22) vulnerability in Solarwinds Access Rights Manager. Its CVSS base score is 9.6 (Critical).
Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
SolarWinds Access Rights Manager (ARM) contains a directory traversal vulnerability tracked as CVE-2024-23472 and assigned CWE-22. The flaw permits an authenticated user to read and delete arbitrary files within the ARM installation. It received a CVSS 3.1 score of 9.6 with an attack vector of adjacent network, low attack complexity, no required privileges, and impacts to confidentiality, integrity, and availability that affect the broader system scope.
An attacker who already possesses valid credentials can exploit the traversal condition over an adjacent network to access or remove sensitive files stored by the ARM application, potentially leading to unauthorized data exposure or disruption of access-rights management functions.
The vendor addressed the issue in the ARM 2024.3 release, as documented in the official release notes. The current EPSS score of 0.0746 shows no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-20970
Vulnerability details
SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read and delete files in ARM.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.