{"id":"CVE-2024-23471","title":"SolarWinds Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution Vulnerability","summary":"The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in remote code execution. ","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-287"],"vendor":"SolarWinds","product":"Access Rights Manager","affected":["access_rights_manager >= previous versions <= 2023.2.4"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2024-07-19T03:55:35.284393Z"},"published":"2024-07-17","updated":"2026-11-03","sourceUpdated":"2026-11-03T23:54:22.682Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-23471","references":[{"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm"}],"tags":["cve.org"],"epss":0.01344,"epssPercentile":0.71561,"ingestedAt":"2026-11-05T20:33:06.635Z","slug":"CVE-2024-23471","body":"## Overview\n\nThe SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in remote code execution. \n\n## Affected\n\n- `access_rights_manager >= previous versions <= 2023.2.4`\n\n## Remediation\n\n\nAll SolarWinds Access Rights Manager customers are advised to upgrade to the latest version of the SolarWinds Access Rights Manager 2024.3","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}