{"id":"CVE-2024-23467","title":"SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability","summary":"The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform remote code execution.","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"SolarWinds","product":"Access Rights Manager","affected":["access_rights_manager >= previous versions <= 2023.2.4"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2024-07-19T03:55:33.885539Z"},"published":"2024-07-17","updated":"2026-11-03","sourceUpdated":"2026-11-03T23:53:53.287Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-23467","references":[{"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm"}],"tags":["cve.org"],"epss":0.02928,"epssPercentile":0.8715,"ingestedAt":"2026-11-05T20:33:06.635Z","slug":"CVE-2024-23467","body":"## Overview\n\nThe SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform remote code execution.\n\n## Affected\n\n- `access_rights_manager >= previous versions <= 2023.2.4`\n\n## Remediation\n\nAll SolarWinds Access Rights Manager customers are advised to upgrade to the latest version of the SolarWinds Access Rights Manager 2024.3","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.6,"exploitation":0,"ransomware":0},"changes":[]}