CVE-2024-28993: 
SolarWinds Access Rights Manager vulnerability analysis and mitigation

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal and Information Disclosure Vulnerability, identified as CVE-2024-28993. This vulnerability, discovered and reported through Trend Micro's Zero Day Initiative (ZDI), allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information. The vulnerability affects versions prior to ARM 2024.3, which was released on July 17, 2024 (Release Notes).

The vulnerability has been assigned a CVSS v3.1 base score of 7.6 (High) with the following vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal') and allows for directory traversal that can lead to unauthorized file deletion and information disclosure (NVD).

If exploited, this vulnerability enables unauthorized users to perform two primary malicious actions: arbitrary file deletion and sensitive information leakage. This could potentially lead to data loss and exposure of confidential information within the Access Rights Manager environment (SecurityWeek).

While the vulnerability requires no authentication to exploit and has a low attack complexity, there have been no reports of this vulnerability being exploited in the wild (Arctic Wolf).

SolarWinds has released version 2024.3 of Access Rights Manager to address this vulnerability. Organizations using affected versions of ARM are strongly advised to upgrade to ARM 2024.3 as soon as possible to mitigate the risk (Release Notes).