CVE-2024-28074: 
SolarWinds Access Rights Manager vulnerability analysis and mitigation

A vulnerability was discovered in SolarWinds Access Rights Manager (ARM) where a previous security fix was found to be incomplete. The vulnerability, tracked as CVE-2024-28074, affects versions up to and including ARM 2023.2.4. This internal deserialization remote code execution vulnerability was discovered and reported through the Trend Micro Zero Day Initiative (ZDI) (Release Notes).

The vulnerability is classified as Critical with a CVSS v3.1 base score of 9.6, indicating high severity. The vulnerability is related to CWE-502 (Deserialization of Untrusted Data). The attack vector is adjacent network (AV:A), with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). The scope is changed (S:C), with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability allows an unauthenticated user to bypass implemented controls and execute code with elevated system privileges. The vulnerability poses significant risks to the security of systems running affected versions of SolarWinds Access Rights Manager (Security Week).

The vulnerability can be exploited by an unauthenticated attacker with access to the adjacent network. The attack complexity is considered low, making it relatively straightforward to exploit. No user interaction is required for successful exploitation (Hacker News).

SolarWinds has addressed this vulnerability in Access Rights Manager version 2024.3, released on July 17, 2024. Organizations using affected versions must upgrade to ARM 2024.3 to protect against this vulnerability. Users must be on ARM 2023.2.4 before upgrading to ARM 2024.3 (Release Notes).