CVE-2023-23840
SolarWinds Platform Exposed Dangerous Method Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.
La plataforma SolarWinds era susceptible a la vulnerabilidad de ComparaciĆ³n Incorrecta. Esta vulnerabilidad permite a los usuarios con acceso administrativo a SolarWinds Web Console ejecutar comandos arbitrarios con privilegios de SERVICIO DE RED.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Platform. Authentication is required to exploit this vulnerability.
The specific flaw exists within the UpdateAction method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-01-18 CVE Reserved
- 2023-09-13 CVE Published
- 2024-08-02 CVE Updated
- 2024-09-19 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-697: Incorrect Comparison
CAPEC
- CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
References (2)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Solarwinds Search vendor "Solarwinds" | Orion Platform Search vendor "Solarwinds" for product "Orion Platform" | < 2023.3.1 Search vendor "Solarwinds" for product "Orion Platform" and version " < 2023.3.1" | - |
Affected
|