SolarWinds Vulnerabilities and Affected Products
Vulnerabilities associated with SolarWinds Platform.
Products
Clear product- SolarWinds Platform41 vulnerabilities
- Serv-U37 vulnerabilities
- Access Rights Manager32 vulnerabilities
- Orion Platform24 vulnerabilities
- access_rights_manager23 vulnerabilities
- Web Help Desk19 vulnerabilities
- solarwinds_platform8 vulnerabilities
- Network Configuration Manager7 vulnerabilities
- SolarWinds Observability Self-Hosted7 vulnerabilities
- Kiwi Syslog Server5 vulnerabilities
- Database Performance Analyzer4 vulnerabilities
- webhelpdesk4 vulnerabilities
- Orion3 vulnerabilities
- Patch Manager3 vulnerabilities
- SolarWinds SEM3 vulnerabilities
- Database Performance Analyzer (DPA)2 vulnerabilities
- Kiwi CatTools2 vulnerabilities
- Network Performance Monitor2 vulnerabilities
- Observability Self-Hosted2 vulnerabilities
- ServU2 vulnerabilities
- SolarWinds2 vulnerabilities
- Dameware Mini Remote Control Service1 vulnerability
- dameware_mini_remote_control1 vulnerability
- Database Performance Monitor1 vulnerability
- DPA1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
SolarWinds Platform Information Disclosure VulnerabilityThe SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive, the information could assist an attacker in other malicious actions. CWE-209Feb 11, 2025 | CVSS3.5v3.1 | EPSS0.346% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-52612MEDIUM | SolarWinds Platform Reflected Cross-Site Scripting VulnerabilitySolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. This vulnerability requires authentication by a high- privileged account to be exploitable. CWE-79Feb 11, 2025 | CVSS6.8v3.1 | EPSS0.524% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-45717HIGH | SolarWinds Platform Cross- Site Scripting VulnerabilityThe SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. This vulnerability requires authentication and requires user interaction. CWE-79Dec 4, 2024 | CVSS7.0v3.1 | EPSS0.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-45715HIGH | SolarWinds Platform Edit Function Cross-Site Scripting VulnerabilityThe SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements. CWE-79Oct 16, 2024 | CVSS7.1v3.1 | EPSS0.334% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-45710HIGH | SolarWinds Platform Uncontrolled Search Path Element Local Privilege Escalation VulnerabilitySolarWinds Platform is susceptible to an Uncontrolled Search Path Element Local Privilege Escalation vulnerability. This requires a low privilege account and local access to the affected node machine. CWE-427Oct 16, 2024 | CVSS7.8v3.1 | EPSS0.278% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-29004HIGH | SolarWinds Platform Stored XSS VulnerabilityThe SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability. CWE-79Jun 4, 2024 | CVSS7.1v3.1 | EPSS0.32% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-28999MEDIUM | SolarWinds Platform Race Condition VulnerabilityThe SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console. CWE-362Jun 4, 2024 | CVSS6.4v3.1 | EPSS13.9% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-28996HIGH | SolarWinds Platform SWQL Injection VulnerabilityThe SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability. CWE-89Jun 4, 2024 | CVSS7.5v3.1 | EPSS0.349% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-29000HIGH | SolarWinds Platform Reflected XSS VulnerabilityThe SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability. CWE-79May 20, 2024 | CVSS7.9v3.1 | EPSS0.463% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-29003HIGH | SolarWinds Platform Cross Site Scripting VulnerabilityThe SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requires authentication and requires user interaction. CWE-79Apr 18, 2024 | CVSS7.5v3.1 | EPSS0.696% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-29001HIGH | SolarWinds Platform SWQL Injection VulnerabilityA SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user interaction to be exploited. CWE-89Apr 18, 2024 | CVSS7.5v3.1 | EPSS0.59% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-28076HIGH | SolarWinds Platform Arbitrary Open Redirection VulnerabilityThe SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL parameter with relative entry in the correct format CWE-601Apr 18, 2024 | CVSS7.0v3.1 | EPSS0.341% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-35188HIGH | SQL Injection Remote Code Execution VulnerabilitySQL Injection Remote Code Execution Vulnerability was found using a create statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited. CWE-89Feb 6, 2024 | CVSS8.0v3.1 | EPSS1.54% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-50395HIGH | SQL Injection Remote Code Execution VulnerabilitySQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited CWE-89Feb 6, 2024 | CVSS8.0v3.1 | EPSS1.58% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-40056HIGH | SolarWinds Platform SQL Injection Remote Code Execution VulnerabilitySQL Injection Remote Code Vulnerability was found in the SolarWinds Platform. This vulnerability can be exploited with a low privileged account. CWE-89Nov 28, 2023 | CVSS8.0v3.1 | EPSS4.81% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-40061HIGH | Insecure Job Execution Mechanism VulnerabilityInsecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result. CWE-20Nov 1, 2023 | CVSS8.8v3.1 | EPSS0.419% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-40062HIGH | Incomplete List of Disallowed Inputs Remote Code Execution VulnerabilitySolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user to execute commands with SYSTEM privileges. CWE-20Nov 1, 2023 | CVSS8.0v3.1 | EPSS2.73% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-23845MEDIUM | SolarWinds Platform Exposed Dangerous Method VulnerabilityThe SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges. | CVSS6.8v3.1 | EPSS5.43% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-23840MEDIUM | SolarWinds Platform Exposed Dangerous Method VulnerabilityThe SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges. | CVSS6.8v3.1 | EPSS5.43% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-3622MEDIUM | Access Control Bypass Vulnerability in the SolarWinds PlatformAccess Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource | CVSS4.3v3.1 | EPSS0.751% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
SolarWinds Platform Incorrect Input Neutralization VulnerabilityThe SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML. CWE-94Jul 26, 2023 | CVSS3.5v3.1 | EPSS0.772% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-23843HIGH | SolarWinds Platform Incorrect Comparison VulnerabilityThe SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands. CWE-697Jul 26, 2023 | CVSS7.2v3.1 | EPSS2.56% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-33224HIGH | SolarWinds Platform Incorrect Behavior Order VulnerabilityThe SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges. CWE-696Jul 26, 2023 | CVSS7.2v3.1 | EPSS2.79% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-33225HIGH | SolarWinds Platform Deserialization of Untrusted Data VulnerabilityThe SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges. | CVSS7.2v3.1 | EPSS3.21% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-23844HIGH | SolarWinds Platform Incomplete List of Disallowed Inputs VulnerabilityThe SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges. | CVSS7.2v3.1 | EPSS3.01% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |