SolarWinds Access Rights Manager (ARM) Traversal Remote Code Execution Vulnerability 

Summary

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.

We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.

Affected Products

• SolarWinds Access Rights Manager (ARM) 2023.2.2 and prior versions

Fixed Software Release

• SolarWinds Access Rights Manager (ARM) 2023.2.3

Acknowledgments

• Anonymous working with Trend Micro Zero Day Initiative