CVE-2024-23479: RCE in SolarWinds Access Rights Manager

The impact of CVE-2024-23479 is severe due to its unauthenticated nature and the potential for Remote Code Execution. An attacker could leverage this vulnerability to gain initial access to a network, escalate privileges, and move laterally to other systems. The attacker could then steal sensitive data, install malware, or disrupt critical business operations. Given SolarWinds ARM's role in access management, a successful exploit could grant an attacker control over privileged accounts and access to highly sensitive resources. This vulnerability shares similarities with other directory traversal exploits where attackers leverage predictable file paths to bypass security controls.

1. Reserved2024-01-17
2. Published2024-02-15
3. Modified2024-08-06
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-23479 is to immediately upgrade SolarWinds Access Rights Manager to version 2023.2.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the ARM server and implementing strict firewall rules to limit inbound connections. Monitor ARM logs for suspicious activity, particularly attempts to access unusual file paths. Implement a Web Application Firewall (WAF) with rules to block directory traversal attempts. After upgrading, confirm the fix by attempting to trigger the vulnerability using a known exploit pattern and verifying that the attempt is blocked.