Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-28076
CVE-2024-28076:
SolarWinds Platform vulnerability analysis and mitigation
Overview
The SolarWinds Platform was identified with an Arbitrary Open Redirection Vulnerability (CVE-2024-28076), discovered and disclosed on April 18, 2024. This vulnerability affects SolarWinds Platform 2024.1 and prior versions. The vulnerability was discovered by Nils Putnins working with NATO (Vendor Advisory).
Technical details
The vulnerability allows potential attackers to redirect to different domains when using URL parameters with relative entries in the correct format. The severity of this vulnerability has been assessed with different CVSS v3.1 scores: SolarWinds rated it as High with a score of 7.0 (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L), while NVD rated it as Low with a score of 3.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N). The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (NVD).
Impact
When successfully exploited, this vulnerability enables attackers to perform arbitrary open redirections, potentially leading to users being redirected to malicious domains. This could result in information disclosure and potential compromise of user security (Vendor Advisory).
Mitigation and workarounds
SolarWinds has released a fix for this vulnerability in SolarWinds Platform 2024.1 SR1 (Service Release 1). Users are advised to upgrade to this version to mitigate the vulnerability (Release Notes).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management