{"affected":[{"defaultStatus":"affected","product":"Access Rights Manager","source":"CNA: SolarWinds","vendor":"SolarWinds","versions":[{"lessThanOrEqual":"2023.2.4","status":"affected","version":"previous versions","versionType":"2024.3"}]},{"defaultStatus":"unknown","product":"access_rights_manager","source":"ADP: CISA-ADP","vendor":"solarwinds","versions":[{"lessThanOrEqual":"2023.2.4","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2024.3","status":"affected","version":"0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:solarwinds:access_rights_manager:*:*:*:*:*:*:*:*","versionEndIncluding":"2023.2.4","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-23471","cwes":["CWE-287"],"description":"The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in remote code execution. ","epss":{"date":"2026-11-03","percentile":0.71427,"score":0.01344},"exploits":[],"kev":null,"metrics":[{"score":9.6,"severity":"critical","source":"CNA: SolarWinds","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},{"score":8.8,"severity":"high","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.6,"severity":"critical","source":"NVD: psirt@solarwinds.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793750062682,"publishedAt":1721226688669,"references":[{"source":"CNA: SolarWinds","tags":[],"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm"},{"source":"psirt@solarwinds.com","tags":["Release Notes"],"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm"}],"remediation":[{"kind":"fix","source":"CNA: SolarWinds","text":"\nAll SolarWinds Access Rights Manager customers are advised to upgrade to the latest version of the SolarWinds Access Rights Manager 2024.3\n\n\n"}],"revision":"d56c97f721a641c82a95e9f32b921c155326ccaa1b7793aa51ffa9787081c878","sources":[{"modifiedAt":1793750062682,"name":"CNA: SolarWinds","retrievedAt":1793750945849,"url":"https://www.cve.org/CVERecord?id=CVE-2024-23471"},{"modifiedAt":1793744235307,"name":"NVD","retrievedAt":1793751361429,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23471"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793743932569,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23471"}],"ssvc":{"assessedAt":1721361335284,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"SolarWinds Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution Vulnerability","updatedAt":1793751361429}