9.1Kritik
KEV
CVE-2024-28987SolarWinds Web Help Desk Hardcoded Credential Vulnerability
Aktif olarak istismar ediliyor — SolarWinds Web Help Desk Hardcoded Credential Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 15.10.2024 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 05.11.2024.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987 ; https://nvd.nist.gov/vuln/detail/CVE-2024-28987
Açıklama
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
Zayıflık türü (CWE):
CWE-798
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| SolarWinds | Web Help Desk | 12.8.3 Hotfix 1 and previous versions | |
| solarwinds | webhelpdesk | ≤ 12.8.3 |
Kaynaklar ve yamalar
- https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987 Vendor Advisory
- https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2 Release Notes
- https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/ Press/Media CoverageThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987 US Government Resource
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*< 12.8.3cpe:2.3:a:solarwinds:web_help_desk:12.8.3:-:*:*:*:*:*:*cpe:2.3:a:solarwinds:web_help_desk:12.8.3:hotfix1:*:*:*:*:*:*