CVE-2024-28999
MEDIUMSolarWinds Platform < 2024.2 - Race Condition in Web Console
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-28999. PoCs published by Elhussain Fathy, HussainFathy.
AI-analyzed exploit summary This exploit leverages a race condition in SolarWinds Platform 2024.1 SR1 to bypass authentication by concurrently testing multiple passwords with pre-established sessions. It uses asynchronous requests to exploit the vulnerability.
Description
The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.
Exploits (2)
This exploit leverages a race condition in SolarWinds Platform 2024.1 SR1 to bypass authentication by concurrently testing multiple passwords with pre-established sessions. It uses asynchronous requests to exploit the vulnerability.
This exploit leverages a race condition vulnerability in the SolarWinds Platform login page (CVE-2024-28999) to brute-force credentials by sending concurrent authentication requests with different passwords. It uses asyncio to exploit the race condition, potentially bypassing authentication limits.
References (2)
Scores
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L