CVE-2024-28991

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Sep 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-289928.3The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability a CVE-2024-289938.3The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability a CVE-2024-289957.5SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machi CVE-2024-289967.5The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability.CVE-2024-289997.5The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.CVE-2024-29008.8A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of th CVE-2024-290004.3The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-pr CVE-2024-290017.4A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user CVE-2024-290034.8The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requi CVE-2024-290044.3The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privi CVE-2024-290069.8By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This cou CVE-2024-290077.3The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means o