CVE-2024-28989

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-321CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-28998.8A vulnerability, which was classified as critical, has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetWiCVE-2024-289908.8SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this CVE-2024-289918.0SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerabilitCVE-2024-289928.3The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability aCVE-2024-289938.3The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability aCVE-2024-289957.5SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machiCVE-2024-289967.5The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability.CVE-2024-289997.5The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.CVE-2024-29008.8A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of thCVE-2024-290004.3The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-prCVE-2024-290017.4A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and userCVE-2024-290034.8The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requi