Patch Manager
Monthly
Information disclosure in SolarWinds Patch Manager lets local users access sensitive data that can be used to escalate privileges on the host. The vendor CVSS vector requires local access and high privileges, but the independent assessment notes that a lower-privileged local account may be sufficient; because there is no remote vector, the issue is low-to-moderate priority. No public exploit identified at time of analysis and no CISA KEV entry is indicated in the provided data.
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Information disclosure in SolarWinds Patch Manager lets local users access sensitive data that can be used to escalate privileges on the host. The vendor CVSS vector requires local access and high privileges, but the independent assessment notes that a lower-privileged local account may be sufficient; because there is no remote vector, the issue is low-to-moderate priority. No public exploit identified at time of analysis and no CISA KEV entry is indicated in the provided data.
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.