SolarWinds Platform Command Injection 

(CVE-2022-36962)

Download PDF

Summary

SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands.

 

Affected Products

  • SolarWinds Platform 2022.3 and earlier
  • Orion Platform 2020.2.6 HF5 and earlier

 

Fixed Software Release

  • SolarWinds Platform 2022.4

 

Acknowledgments

  • Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative

 

Workarounds

SolarWinds recommends customers upgrade to SolarWinds Platform version 2022.4 as soon as it becomes available. The target release is the end of November. SolarWinds also recommends that customers follow the guidance provided in the SolarWinds Secure Configuration Guide. Ensure only authorized users can access the SolarWinds Platform.

Advisory Details

Severity

7.2 High

Advisory ID

First Published

11/22/2022

Fixed Version

SolarWinds Platform 2022.4

Workarounds

CVSS Score