The version of SolarWinds ARM installed on the remote host is prior to 2023.2.3. It is, therefore, affected by multiple vulnerabilities as referenced in the arm_2023-2-3 advisory.

  - The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability.
    If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in     remote code execution. (CVE-2023-40057)

  - The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote     Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve     the Remote Code Execution. (CVE-2024-23476)

  - The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote     Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a     Remote Code Execution. (CVE-2024-23477)

  - SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution     Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds     service, resulting in remote code execution. (CVE-2024-23478)

  - SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code     Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a     Remote Code Execution. (CVE-2024-23479)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SolarWinds ARM < 2023.2.3 Multiple Vulnerabilities (arm_2023-2-3)

critical Nessus Plugin ID 190889

Version 1.2

Version 1.1

Version 1.0

Version 1.2 May 17, 2024, 10:54 AM IAVM reference Plugin Feed: 202405171054
Version 1.1 Feb 23, 2024, 3:16 PM STIG Severity (set to "I") IAVM reference Plugin Feed: 202402231516
Version 1.0 Feb 22, 2024, 6:43 PM New Plugin Feed: 202402221843