CVE-2023-33224

Published Jul 26, 2023

Last updated a year ago

Overview

Description: The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.
Source: psirt@solarwinds.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-Other
psirt@solarwinds.com: CWE-696

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:solarwinds:solarwinds_platform:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9722CBBC-46EC-4167-8E98-AEBB8ACF74D8",
            "versionEndExcluding": "2023.3.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References