CVE-2024-28993

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
SolarWinds	Access Rights Manager	>= previous versions, <= 2023.2.4

References

https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htmRelease Notes, Vendor Advisory
https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htmRelease Notes, Vendor Advisory

Timeline

Published: Jul 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-289957.5SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machi CVE-2024-289967.5The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability.CVE-2024-289997.5The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.CVE-2024-29008.8A vulnerability, which was classified as critical, was found in Tenda AC7 15.03.06.44. This affects the function saveParentControlInfo of th CVE-2024-290004.3The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-pr CVE-2024-290017.4A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user CVE-2024-290034.8The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requi CVE-2024-290044.3The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privi CVE-2024-290069.8By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This cou CVE-2024-290077.3The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means o CVE-2024-290086.4A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has pri CVE-2024-290096.1Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authe